TSplus Remote Access EUVD-2026-100980

Exploitation requires network reachability to the TSplus Remote Access web server and the ability to send requests to the /socket.io/JWN/ endpoint with manipulated path components; per PR:N/UI:N/AC:L/AT:N no authentication, no user interaction, and no non-default configuration are needed, so default internet-exposed portals are directly affected. The practical limiting factor is exposure of the web portal itself - instances restricted to internal networks, VPN-fronted, or placed behind a reverse proxy/WAF that normalizes or blocks the manipulated /socket.io/JWN/ paths substantially reduce reachability. Impact is bounded to disclosure of protected internal resources (confidentiality), not modification or service disruption.

The CVSS 4.0 base score of 8.7 (High) is driven by a clean remote-unauthenticated profile: AV:N (network), AC:L (low complexity), AT:N (no special attack requirements), PR:N (no privileges) and UI:N (no user interaction), with impact confined to confidentiality (VC:H; VI/VA:N). This means a successful attack exposes protected internal resources but does not, by itself, modify data or disrupt availability. Weighing the signals: no EPSS probability was supplied in the input, there is no CISA KEV listing, and no public exploit code is referenced, so there is no evidence of active or at-scale exploitation - the score reflects potential impact and ease of access rather than observed abuse. The access-control-bypass nature (CWE-552) combined with an unauthenticated network vector makes this a genuine priority for exposed TSplus Remote Access portals rather than a high-CVSS/low-real-risk artifact, but prioritization should be tempered by the information-disclosure-only impact and the absence of exploitation telemetry. Key missing data: EPSS score, confirmed fixed version, and any vendor advisory detail beyond the aggregated INCIBE notice - these should be verified with TSplus before treating remediation urgency as fully characterized.

An unauthenticated attacker who can reach the TSplus Remote Access web portal over the network sends crafted requests to the /socket.io/JWN/ endpoint using manipulated path components that bypass the intended access restrictions, retrieving internal resources that should not be externally reachable. No authentication, user interaction, or special preconditions are required, so any internet-exposed instance is reachable directly. No public proof-of-concept is referenced in the provided data.