# CVE-2026-8214: IAS Canias ERP improper authentication in RMI Interface

Source: https://junglewise.ai/threats/cve-2026-8214-ias-canias-erp-improper-authentication-in-rmi-interface  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-10. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-8214 · Severity: medium · CVSS 5.3 · Published 2026-05-10

Industrial Application Software (IAS) Canias ERP, an enterprise resource planning platform used in manufacturing and industrial environments, contains a security flaw in its remote communication interface. An unauthenticated attacker can remotely query the system to obtain a list of all currently active user sessions, including session IDs, usernames, and IP addresses. This information can be used as a stepping stone to hijack active sessions and eventually gain full control over the server.

## Quick answers

**Is CVE-2026-8214 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-8214 being exploited in the wild.

**How severe is CVE-2026-8214?** Medium severity, with a CVSS score of 5.3, published 10 May 2026.

**Which products and versions are affected?** Industrial Application Software (IAS) Canias ERP 8.03.

**Is there a fix for CVE-2026-8214?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-8214 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-8214?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An improper authentication vulnerability (CWE-287) exists in the 'doAction' function of the Java RMI Interface in IAS Canias ERP 8.03. The 'iasGetUserListEvent' handler fails to validate authentication or session state before processing requests. A remote, unauthenticated attacker can craft a malicious RMI request to trigger this event, which returns a list of all active 'iasSessionInfo' objects. This leaked data includes sensitive session identifiers (sessionId), usernames, and client IP addresses. These session IDs can subsequently be used to bypass authentication in other interface methods, forming part of a chain that leads to remote code execution (RCE). As of the advisory date, the vendor has not provided a patch.

## Affected products

- Industrial Application Software (IAS) Canias ERP 8.03

## Timeline

- 2025-04: other: Vulnerability research began
- 2026-05-09: disclosed: Public disclosure by security researcher
- 2026-05-10: advisory: CVE published to NVD

## References

- [https://gist.github.com/0xb1lal/3ef872a445310c5866d07d6a5b1803fa](https://gist.github.com/0xb1lal/3ef872a445310c5866d07d6a5b1803fa)
- [https://hawktrace.com/blog/caniaserp/](https://hawktrace.com/blog/caniaserp/)
- [https://vuldb.com/submit/808238](https://vuldb.com/submit/808238)
- [https://vuldb.com/vuln/362431](https://vuldb.com/vuln/362431)
- [https://vuldb.com/vuln/362431/cti](https://vuldb.com/vuln/362431/cti)