CVE-2026-8464
Path traversal in Neuron Soft Golem OEE MES
- State
- Published
- Severity
- 8.3 High
- Published
- Jun 11, 2026
- Updated
- Jun 11, 2026
- Reserved
- May 13, 2026
Description
Golem OEE MES is vulnerable to an unauthenticated path traversal flaw. This vulnerability allows an attacker in the same local network to read arbitrary files from the server's operating system by manipulating HTTP request paths. This issue has been fixed in version 11.6.0
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.3 High | CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N | CERT-PL |
Weaknesses
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected Products
| Product | Versions |
|---|---|
Golem OEE MESNeuron Soft |
|
References
- https://www.neuron.com.pl/mes-help/mes-download.htmlrelease-notes
- https://cert.pl/posts/2026/06/CVE-2026-8464third-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.