CVE-2026-8242

LowCVSS 3.7/10Last modified Jul 24, 2026

Description

A vulnerability was found in Industrial Application Software IAS Canias ERP 8.03. The impacted element is the function doAction of the component Login RMI Interface. Performing a manipulation results in observable response discrepancy. The attack is possible to be carried out remotely. A high degree of complexity is needed for the attack. The exploitability is regarded as difficult. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 3.7/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-203 CWE-204

Affected software

No affected versions have been published.

Timeline

Published: May 10, 2026
Last modified: Jul 24, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-824216.3A vulnerability was identified in itsourcecode Sales and Inventory System 1.0. This issue affects some unknown processing of the file /pages CVE-2026-824226.3A security flaw has been discovered in itsourcecode Sales and Inventory System 1.0. Impacted is an unknown function of the file /pages/emp_d CVE-2026-824235.4A vulnerability has been found in macrozheng mall up to 1.0.3. The affected element is an unknown function of the file /order/paySuccess of CVE-2026-824246.3A weakness has been identified in PHPGurukul Student Information System 1.0. Affected by this vulnerability is an unknown functionality of t CVE-2026-82425A reachable assertion in Apache bRPC (version < 1.18.0) on all platforms allows a malicious remote peer to crash the process, resulting in d CVE-2026-824266.5Description Nimbus accepted the `uploadedJarLocation` argument of `submitTopology` / `submitTopologyWithOpts` as a server-side path and ope CVE-2026-824277.8Description A topology's `topology.blobstore.map` lets the submitter choose a local name for each blob that the supervisor localises. That CVE-2026-824288.8Description Dependency artifacts uploaded with `storm jar --artifacts` were stored under a blob key derived only from the Maven coordinate,CVE-2026-824297.8Description The setuid-root `worker-launcher` binary adjusts ownership and permissions of worker directories by walking the tree with FTS a CVE-2026-82435.3A vulnerability was determined in Industrial Application Software IAS Canias ERP 8.03. This affects an unknown function of the component JNL CVE-2026-824307.8Description When launching a Docker or OCI worker, the setuid-root `worker-launcher` first changes ownership of the entire worker directory CVE-2026-824319.8Description `SimpleACLAuthorizer` evaluated the user-level command set by returning early when `nimbus.users` was empty, before `nimbus.gro