TSplus Remote Access CVE-2026-108072

Exploitation requires three concrete conditions: (1) the attacker already holds a valid, interactive low-privilege session on the TSplus terminal/remote desktop server (local access, AV:L/PR:L); (2) the autostart1.tscr login script(s) in the shared themes directory are writable by under-privileged users - the incorrect-permissions misconfiguration that is the root cause (CWE-276); and (3) a higher-privileged or different victim user must subsequently log in using the same theme or operating mode (UI:P / AT:P), which is what triggers the injected commands. Limiting factors that reduce realistic risk: no remote/network exploitation is possible, an authenticated local session is mandatory, the attack is passive and cannot be forced (it waits on a victim login), and the eventual impact is bounded by the victim account's privileges - exploitation against a low-value user yields little escalation.

The vendor-supplied CVSS 4.0 vector (5.4, Medium) describes a local, low-complexity attack requiring an existing low-privilege session (AV:L/AC:L/PR:L) plus passive user interaction (UI:P) and a specific attack requirement (AT:P), yielding high confidentiality, integrity, and availability impact on the vulnerable system (VC:H/VI:H/VA:H) with no subsequent-system scope impact (SC:N/SI:N/SA:N). No EPSS score, CISA KEV listing, or public proof-of-concept was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. This is a realistic but conditional insider/post-compromise threat rather than a mass-exploitation priority: it is gated behind already having a valid session on a multi-user terminal/RDS server AND a higher-value user subsequently logging in with the same theme or operating mode. The signals are internally consistent (all point to local, authenticated, interaction-dependent exploitation), so there is no CVSS-versus-reality conflict - but the absence of EPSS/KEV/POC data means exploitation likelihood cannot be quantified, only reasoned to be low for opportunistic attackers and moderate in shared/hostile-insider deployments. Affected version and patch data are missing from the input and must be confirmed with TSplus/INCIBE.

A low-privileged user with a valid session on a shared TSplus Remote Access server edits a world-writable autostart1.tscr login script in the shared themes directory, inserting attacker-controlled commands. When an administrator or higher-privileged user next logs in using that same theme or operating mode, the injected commands run in that victim's security context, enabling lateral movement or privilege escalation. No public exploit code is identified at time of analysis; the attack requires only local file-write access and a standard scripting technique.