What is the CVSS score of CVE-2025-26318?

CVE-2025-26318 has a CVSS 3.1 base score of 5.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N. EPSS exploitation probability: 1.4%.

Which versions of TSplus Remote Access are affected by CVE-2025-26318?

Organizations using TSplus Remote Access should be aware of moderate risk from CVE-2025-26318 rated CVSS 5.8. Exploitation could compromise the security of affected deployments.

How to fix or mitigate CVE-2025-26318?

Within 30 days: Identify affected systems running TSplus Remote Access and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

TSplus Remote Access CVE-2025-26318

MEDIUM

Insertion of Sensitive Information Into Sent Data (CWE-201)

2025-03-04 cve@mitre.org

Information Disclosure

5.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.8 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 28, 2026 - 18:29 vuln.today

CVE Published

Mar 04, 2025 - 21:15 nvd

MEDIUM 5.8

DescriptionCVE.org

hb.exe in TSplus Remote Access before 17.30 2024-10-30 allows remote attackers to retrieve a list of all domain accounts currently connected to the application.

AnalysisAI

hb.exe in TSplus Remote Access before 17.30 2024-10-30 allows remote attackers to retrieve a list of all domain accounts currently connected to the application. Rated medium severity (CVSS 5.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-201. hb.exe in TSplus Remote Access before 17.30 2024-10-30 allows remote attackers to retrieve a list of all domain accounts currently connected to the application. Version information: before 17.30.

Affected ProductsAI

TSplus Remote Access.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.