Path traversal in Neuron Soft Golem OEE MES
Priority LOW 35CWE-22Published · Updated
Key facts
- Attack vector
- Adjacent network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.
Summary
Golem OEE MES is vulnerable to an unauthenticated path traversal flaw. This vulnerability allows an attacker in the same local network to read arbitrary files from the server's operating system by manipulating HTTP request paths. This issue has been fixed in version 11.6.0
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00204 10th percentileScored 2026-11-07
Fix Fixed Golem OEE MES (Neuron Soft): 11.6.0
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Neuron Soft | Golem OEE MES | before 11.6.0 | 11.6.0 | Patch available | CNA |
- Golem OEE MES VendorNeuron Soft Affected before 11.6.0 Fixed in 11.6.0 Patch available CNA
Remediation
- Fix · CNA Golem OEE MES (Neuron Soft) Fixed in 11.6.0
Timeline
- 2026-10-02 Threatist record created from CVE-2026-8464
- 2026-10-03 Alias added: GHSA-v4jp-473q-hxw4
References
Sources
- CVE-2026-8464 · CVE Program
- CVE-2026-8464 · NVD
- FIRST EPSS
- GHSA-v4jp-473q-hxw4 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences