Skip to content

CVE-20XX-?

CVE-2025-26318

5.8 MEDIUM 1.0% exploit odds No fix listed Disclosure

What it is

hb.exe in TSplus Remote Access before 17.30 2024-10-30 allows remote attackers to retrieve a list of all domain accounts currently connected to the application.

At a glance

Exploitability: Can be exploited over the network without logging in. Limited direct impact.
Exploit odds: 1.0% chance of exploitation in the next 30 days (EPSS).
Fix: No patch or advisory is linked yet. Look at mitigations or restrict exposure.

Timeline

2025-03-04 21:15 UTC PublishedDisclosed publicly on CVE.org and NVD
2026-06-17 09:01 UTC Last updatedMost recent change to the record

Details

Published: 2025-03-04 21:15 UTC
Last modified: 2026-06-17 09:01 UTC
Exploit probability: 1.0% · EPSS, next 30 days
Weakness: CWE-201
Record status: Deferred

Attack profile CVSS 3.1 · 5.8

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Scope: Changed
Confidentiality: Low
Integrity: None
Availability: None

Raw vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

Meme: I wake up, CVE-2025-26318

Download Square Reddit

References

https://github.com/Frozenka/CVE-2025-26318

NVD record · CVE.org record