Is there a public PoC exploit available for CVE-2026-8244?

Yes, a public proof-of-concept exploit is available for CVE-2026-8244. Prioritise patching immediately. EPSS: 0.0%.

Canias ERP CVE-2026-8244

Q: What is the CVSS score of CVE-2026-8244?

CVE-2026-8244 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-28993 MEDIUM

Improper Authentication (CWE-287)

2026-05-10 VulDB

GHSA-3h89-3vxh-28m9

Authentication Bypass Canias Erp

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 10, 2026 - 10:30 vuln.today

CVSS changed

May 10, 2026 - 10:22 NVD

5.3 (MEDIUM) 5.5 (MEDIUM)

CVE Published

May 10, 2026 - 09:15 nvd

MEDIUM 5.5

DescriptionCVE.org

A vulnerability was identified in Industrial Application Software IAS Canias ERP 8.03. This impacts an unknown function of the component Login RMI Interface. The manipulation of the argument clientVersion leads to improper authentication. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Improper authentication in Industrial Application Software IAS Canias ERP 8.03 allows unauthenticated remote attackers to bypass login authentication by manipulating the clientVersion argument in the Login RMI Interface component. The vulnerability enables unauthorized access to the ERP system without valid credentials. Publicly available exploit code exists and the vendor has not responded to disclosure attempts.

Technical ContextAI

The vulnerability resides in the Login RMI (Remote Method Invocation) Interface of Canias ERP, a component responsible for handling remote authentication requests. RMI is a Java-based protocol for invoking methods on remote objects across network boundaries. The flaw stems from improper validation of the clientVersion parameter during authentication, allowing attackers to manipulate this argument to bypass authentication checks. This falls under CWE-287 (Improper Authentication), which encompasses weaknesses in authentication logic, credential validation, and session management. The RMI interface exposes authentication functionality directly over the network without adequate input validation or version checking.

RemediationAI

No vendor-released patch is available at this time. The vendor did not respond to early disclosure and no official fix has been announced. Immediate mitigation requires deploying network-level controls: restrict RMI interface access by implementing IP whitelisting at the firewall, allowing only trusted administrative networks to reach the Login RMI port (typically 1099 or vendor-specific RMI ports). Segment the Canias ERP system to an isolated network zone with strict egress/ingress rules. Deploy intrusion detection signatures to alert on malformed clientVersion parameters in RMI traffic. Monitor authentication logs for failed or anomalous login attempts. Consider upgrading to a newer Canias ERP version if available from the vendor, though compatibility and testing requirements should be evaluated. As a last resort, disable remote RMI access if the system can operate in local-only mode, but this impacts distributed deployments. Contact Industrial Application Software IAS directly to request patch availability and timeline.