Vulnerability details

CVE-2026-8464

Neuron Soft Golem OEE MES

Path traversal in Neuron Soft Golem OEE MES

CVSS 4.0

8.3High

Official description

Golem OEE MES is vulnerable to an unauthenticated path traversal flaw. This vulnerability allows an attacker in the same local network to read arbitrary files from the server's operating system by manipulating HTTP request paths. This issue has been fixed in version 11.6.0

CVSS scores

Score	Version	Source	Vector
8.3High	4.0	CVEProject cvelistV5 (CNA) (CERT-PL)	`CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N`

Affected products

Vendor	Product	Versions	Source
Neuron Soft	Golem OEE MES	v < 11.6.0	CVEProject cvelistV5 (CNA)

References and advisories

https://www.neuron.com.pl/mes-help/mes-download.html release-notes
https://cert.pl/posts/2026/06/CVE-2026-8464 third-party-advisory

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-06-11
Last updated: 2026-06-11
State: Published
Assigner (CNA): CERT-PL

Exploit prediction (EPSS)

0.2%

Probability of exploitation in 30 days

10.4%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: None
Technical impact: Partial

Weaknesses (CWE)

CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')