Golem OEE MES hit by path traversal flaw
An unauthenticated path traversal vulnerability in Neuron Soft's Golem OEE MES software lets local network attackers read arbitrary server files.
Sourcecert.pl — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT Polska coordinated the disclosure of CVE-2026-8464, a path traversal vulnerability affecting Golem OEE MES, a manufacturing execution system produced by Neuron Soft. The flaw allows an unauthenticated attacker with access to the same local network to manipulate HTTP request paths and read arbitrary files from the underlying operating system, potentially exposing configuration data, credentials, or other sensitive information stored on the server.
The vulnerability was responsibly reported by Karol Królak of securitum.pl and has been addressed by the vendor in version 11.6.0. There is no indication in the advisory of active exploitation in the wild; this is a coordinated disclosure aimed at prompting affected organizations to patch. Given the requirement for local network access and the lack of evidence of exploitation, this represents a routine vulnerability disclosure rather than an active threat, though organizations running Golem OEE MES in manufacturing environments should prioritize upgrading to remediate exposure.
Mentioned in this report
Detection guidance
Possible Path Traversal Attempt Against Web Application (Golem OEE MES style)
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects HTTP requests containing directory traversal sequences targeting local files, consistent with path traversal exploitation such as CVE-2026-8464 in Golem OEE MES. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Possible Path Traversal Attempt Against Web Application
id: 3ca0ddce-9090-5457-a1f6-263e66b2a371
status: experimental
description: 'Detects HTTP requests containing directory traversal sequences (raw
or URL-encoded) that attempt to escape the web root and read arbitrary files from
the underlying operating system.
This pattern matches the behaviour described in CVE-2026-8464 affecting Golem OEE
MES, where an unauthenticated attacker on the local network could manipulate request
paths to read sensitive files.
'
references:
- https://cert.pl
logsource:
category: webserver
detection:
selection_raw:
cs-uri-query|contains:
- ../
- ..\\
selection_encoded:
cs-uri-query|contains:
- '%2e%2e%2f'
- '%2e%2e/'
- ..%2f
- '%2e%2e%5c'
- ..%5c
filter:
cs-uri-query|contains:
- /assets/../
- /static/../
condition: (selection_raw or selection_encoded) and not filter
falsepositives:
- Legitimate applications using relative path references in query strings for asset
versioning
- Vulnerability scanners or penetration testing tools performing authorized security
assessments
level: medium
tags:
- attack.t1190
- attack.initial-access
author: Vorant
HTTP Request Attempting to Read Sensitive OS Files via Traversal
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects HTTP requests whose path traversal sequences target well-known sensitive OS configuration or credential files, indicating likely exploitation of a path traversal vulnerability such as CVE-2026-8464. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: HTTP Request Attempting to Read Sensitive OS Files via Traversal
id: ee0f4209-bfdb-5c5e-91ff-b152e92f3218
status: experimental
description: 'Detects HTTP requests combining directory traversal sequences with references
to sensitive operating system files (e.g. passwd, shadow, web.config, boot.ini,
SAM hive paths).
This behaviour is consistent with exploitation of path traversal vulnerabilities
in web-exposed industrial software such as Golem OEE MES (CVE-2026-8464), where
an attacker reads arbitrary OS files through manipulated request paths.
'
references:
- https://cert.pl
logsource:
category: webserver
detection:
selection_traversal:
cs-uri-query|contains:
- ../
- ..%2f
- '%2e%2e%2f'
selection_target:
cs-uri-query|contains:
- etc/passwd
- etc/shadow
- win.ini
- boot.ini
- web.config
- system32/config
- .ssh/id_rsa
condition: selection_traversal and selection_target
falsepositives:
- Authorized penetration testing or vulnerability scanning against the web application
level: high
tags:
- attack.t1190
- attack.initial-access
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/06/CVE-2026-8464
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs