Is CVE-2026-8217 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-8217 being exploited in the wild.

How severe is CVE-2026-8217?

Medium severity, with a CVSS score of 6.3, published 10 May 2026.

Which products and versions are affected?

Industrial Application Software IAS Canias ERP 8.03.

Is there a fix for CVE-2026-8217?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-8217 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-8217?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-8217: Industrial Application Software IAS Canias ERP OS command injection in RMI Interface

CVE-2026-8217 · Severity: medium · CVSS 6.3 · Published 2026-05-10

A security vulnerability exists in Canias ERP, a software suite used for managing industrial and manufacturing operations. An attacker can exploit this flaw to execute unauthorized commands on the server, potentially leading to a full system takeover or theft of sensitive business data. While the exploit requires an active session, researchers have demonstrated that sessions can be hijacked without any prior credentials, making this a high-risk issue for exposed servers.

Quick answers

Is CVE-2026-8217 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-8217 being exploited in the wild.
How severe is CVE-2026-8217?: Medium severity, with a CVSS score of 6.3, published 10 May 2026.
Which products and versions are affected?: Industrial Application Software IAS Canias ERP 8.03.
Is there a fix for CVE-2026-8217?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-8217 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-8217?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An OS command injection vulnerability exists in the RMI Interface of IAS Canias ERP 8.03. The root cause is the improper neutralization of special elements in the 'troiaCode' argument within the iasCtiRunCodeEvent function, which is subsequently passed to Runtime.getRuntime().exec(). While the CVSS vector indicates low privileges are required, researchers have demonstrated that an unauthenticated attacker can obtain a valid session ID by exploiting related vulnerabilities (CVE-2026-8214 and CVE-2026-8216) to hijack active sessions. Once a session is hijacked, the attacker can execute arbitrary OS commands with the privileges of the caniasERP service account. As of the advisory date, the vendor has not responded to disclosure attempts and no patch is available.

Affected products

Industrial Application Software IAS Canias ERP 8.03

Timeline

2025-04: other: Vulnerability research began
2026-05-09: disclosed: Public disclosure by HawkTrace researchers
2026-05-10: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.