IAS Canias ERP CVE-2026-8214

Q: What is the CVSS score of CVE-2026-8214?

CVE-2026-8214 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-28950 MEDIUM

Improper Authentication (CWE-287)

2026-05-10 cna@vuldb.com

GHSA-j783-26g6-74r3

Authentication Bypass

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 10, 2026 - 01:29 vuln.today

CVE Published

May 10, 2026 - 01:16 nvd

MEDIUM 5.5

DescriptionCVE.org

A vulnerability was found in Industrial Application Software IAS Canias ERP 8.03. This affects the function doAction of the component RMI Interface. The manipulation of the argument sessionId results in improper authentication. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Authentication bypass in IAS Canias ERP 8.03 RMI Interface allows remote attackers to manipulate the sessionId parameter in the doAction function, circumventing authentication controls without requiring credentials or user interaction. Publicly available exploit code exists, and the vendor has not responded to disclosure efforts, leaving affected deployments without an official patch.

Technical ContextAI

The vulnerability resides in the RMI (Remote Method Invocation) Interface component of IAS Canias ERP, a Java-based industrial application. RMI is a Java mechanism for remote procedure calls that typically relies on session tokens for maintaining authenticated state. The root cause is improper validation of the sessionId argument in the doAction method (CWE-287: Improper Authentication), allowing attackers to bypass session verification by directly manipulating this parameter. The RMI interface is network-accessible by default, exposing this flaw to remote exploitation without authentication prerequisites.

RemediationAI

Immediate action: Isolate or restrict network access to the RMI Interface port (typically port 1099 for Java RMI) using firewall rules to limit connectivity to trusted internal networks only. Contact IAS vendor (Industrial Application Software) directly to request a security update or patch; given the vendor's prior non-responsiveness, escalate through your software support contract or consider migrating to a supported ERP platform. As a temporary compensating control, implement reverse-proxy authentication in front of the RMI service or deploy a network-level access control list to whitelist only authorized client IP ranges. Monitor RMI connections and sessionId parameters for signs of unauthorized manipulation. No vendor-released patch has been identified at time of analysis; prioritize upgrading to Canias ERP version 8.04 or later if available, or request an interim security advisory from IAS. Given the lack of vendor engagement, evaluate the long-term supportability of this product version.