IAS Canias ERP CVE-2026-8216

Q: What is the CVSS score of CVE-2026-8216?

CVE-2026-8216 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-28952 MEDIUM

Improper Authentication (CWE-287)

2026-05-10 cna@vuldb.com

GHSA-h422-7cwm-p78c

Authentication Bypass Java

6.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 10, 2026 - 01:29 vuln.today

CVE Published

May 10, 2026 - 01:16 nvd

MEDIUM 6.9

DescriptionCVE.org

A vulnerability was identified in Industrial Application Software IAS Canias ERP 8.03. This issue affects the function iasServerRemoteInterface.doAction of the component Java RMI Session Management. Such manipulation leads to improper authentication. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Improper authentication in IAS Canias ERP 8.03 allows remote unauthenticated attackers to bypass authentication via the iasServerRemoteInterface.doAction function in the Java RMI Session Management component, granting unauthorized access to ERP functionality without valid credentials. CVSS 6.9 indicates moderate severity with low confidentiality and integrity impact. No public exploit code or active exploitation has been confirmed at time of analysis.

Technical ContextAI

The vulnerability exists in the Java RMI (Remote Method Invocation) Session Management subsystem of IAS Canias ERP, specifically in the iasServerRemoteInterface.doAction method. Java RMI allows remote procedure calls over network connections, and improper authentication validation in session management exposes the interface to unauthorized access. The root cause is classified as CWE-287 (Improper Authentication), indicating the RMI endpoint fails to properly verify caller identity or credentials before executing privileged operations. The remote network attack vector (AV:N) combined with low attack complexity (AC:L) and no privilege requirement (PR:N) means the RMI interface is directly accessible from the network without prior authentication to call the vulnerable function.

RemediationAI

Primary remediation requires vendor patching; however, given the vendor's non-response to disclosure, no official patch version has been confirmed available. Organizations must immediately implement network-level compensating controls: restrict Java RMI port access (typically port 1099 or configured RMI registry port) to trusted internal networks only using firewall rules, implement network segmentation to isolate Canias ERP systems from untrusted networks, and disable remote RMI access if not operationally required. Additionally, enforce strong internal authentication and audit all access to the ERP system to detect unauthorized session creation. Monitor vendor communications and security advisories for emergency patches. If patch availability is confirmed from IAS, upgrade immediately to the patched version. Until network controls are in place, disable or isolate the iasServerRemoteInterface RMI endpoint if operationally feasible, though this may impact legitimate remote ERP administration.