TSplus Remote Access EUVD-2026-100989

Requires the TSplus Remote Access MFA feature to be enabled and the attacker to already hold valid first-factor credentials (a working username/password) for a target account - the flaw is in the second-factor enforcement, not the first factor. The exploitation condition is simply that MFA is relied upon as a protective control; the vulnerability makes that control ineffective. Limiting factors: the attacker cannot start from zero knowledge (PR:L - valid first-factor credentials are a prerequisite), and deployments that do not enable TSplus MFA are not materially affected by this specific second-factor bypass. No victim user interaction is required (UI:N), and the portal is network-reachable (AV:N).

This is a genuine priority despite the absence of exploitation telemetry. The input provides only a CVSS 4.0 vector (8.7, HIGH), with no EPSS score, no CISA KEV listing, and no POC indicator supplied. Signals are therefore limited but internally consistent: the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) aligns tightly with the description - a network-reachable MFA bypass requiring only valid first-factor credentials (PR:L) and no user interaction, yielding full confidentiality, integrity, and availability compromise of protected resources. The core concern is that MFA exists precisely to contain attackers who already hold valid first-factor credentials (phished, reused, or brute-forced passwords); this flaw nullifies that compensating control, so the real-world risk is higher than the PR:L metric alone suggests because stolen credentials are abundant. Conflicting/missing data to note: EPSS is absent, so statistical exploitation probability cannot be stated; KEV status is not present in the input, so there is no confirmed active exploitation; and POC availability is unknown. The CVSS vector cleanly supports the description (no local/remote contradiction), so no vector-versus-description discrepancy needs vendor verification here.

An attacker who already possesses a valid username and password (e.g., from phishing or credential reuse) connects to the TSplus Remote Access portal and begins the login flow. Because the authentication logic does not correctly enforce the MFA validation result, the attacker proceeds past the second-factor prompt without supplying a valid token and reaches the protected applications. No public exploit has been identified at time of analysis, and no user interaction from a victim is required.