CVE-2026-8243

MediumCVSS 5.3/10Last modified Jul 24, 2026

Description

A vulnerability was determined in Industrial Application Software IAS Canias ERP 8.03. This affects an unknown function of the component JNLP Deployment Endpoint. Executing a manipulation can lead to use of hard-coded cryptographic key . The attack may be performed from remote. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-320 CWE-321

Affected software

No affected versions have been published.

Timeline

Published: May 10, 2026
Last modified: Jul 24, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-824307.8Description When launching a Docker or OCI worker, the setuid-root `worker-launcher` first changes ownership of the entire worker directory CVE-2026-824319.8Description `SimpleACLAuthorizer` evaluated the user-level command set by returning early when `nimbus.users` was empty, before `nimbus.gro CVE-2026-824328.1Description Nimbus validated `topology.blobstore.map` against the calling subject at submission time only. The rebalance operation accepts CVE-2026-824336.5Description `getNimbusConf` returned the complete daemon configuration without redaction after only a user-level authorization check. Where CVE-2026-824346.5Description When ZooKeeper authentication is configured, Storm deliberately retains `storm.zookeeper.topology.auth.payload` in the topology CVE-2026-824359.8Description The worker's Netty message decoder is installed ahead of the SASL authentication handlers in the pipeline and acts on frames be CVE-2026-824374.3Description The Logviewer offers `logs.users` and `logs.groups` so operators can control who may read log content. For daemon logs those se CVE-2026-824388.1Description Three separate mechanisms allowed a web page on an unrelated origin to read responses that Storm's HTTP components served to an CVE-2026-824399.8Description The DRPC server kept a map from function name to request queue and created an entry the first time a function name was seen. No CVE-2026-82445.3A vulnerability was identified in Industrial Application Software IAS Canias ERP 8.03. This impacts an unknown function of the component Log CVE-2026-824419.1Description A submitted topology carries two lists of blobstore keys, `dependency_jars` and `dependency_artifacts`, which the client fills CVE-2026-824439.9Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. A