PT-2026-48654 · Unknown · Golem Oee Mes

Karol Królak · Published 2026-06-11 · Updated 2026-06-11 · CVE-2026-8464

Positive Technologies (AI Summary)

CVSS v4.0

8.3

High

Base vector

AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Golem OEE MES versions prior to 11.6.0

Description An unauthenticated path traversal flaw allows an attacker on the same local network to read arbitrary files from the server's operating system by manipulating HTTP request paths. Path traversal is a technique used to access files and directories that are stored outside the web root folder.

Recommendations Update to version 11.6.0.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-8464

Affected Products

Golem Oee Mes

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-8464 · Security Note
• https://neuron.com.pl/mes-help/mes-download.html · Note
• https://twitter.com/f1tym1/status/2065021119317315739 · Twitter Post
• https://cert.pl/posts/2026/06/CVE-2026-8464 · Note