# Golem OEE MES hit by path traversal flaw

Published: 2026-06-11 · Severity: medium · Sectors: manufacturing
Canonical: https://vorant.io/reports/acb34203-cc4e-554b-8830-6d827b229d03/golem-oee-mes-hit-by-path-traversal-flaw

> An unauthenticated path traversal vulnerability in Neuron Soft's Golem OEE MES software lets local network attackers read arbitrary server files.

CERT Polska coordinated the disclosure of CVE-2026-8464, a path traversal vulnerability affecting Golem OEE MES, a manufacturing execution system produced by Neuron Soft. The flaw allows an unauthenticated attacker with access to the same local network to manipulate HTTP request paths and read arbitrary files from the underlying operating system, potentially exposing configuration data, credentials, or other sensitive information stored on the server.

The vulnerability was responsibly reported by Karol Królak of securitum.pl and has been addressed by the vendor in version 11.6.0. There is no indication in the advisory of active exploitation in the wild; this is a coordinated disclosure aimed at prompting affected organizations to patch. Given the requirement for local network access and the lack of evidence of exploitation, this represents a routine vulnerability disclosure rather than an active threat, though organizations running Golem OEE MES in manufacturing environments should prioritize upgrading to remediate exposure.

## Mentioned in this report

- Vulnerabilities: CVE-2026-8464

## Detection guidance (public sample)

### Possible Path Traversal Attempt Against Web Application (Golem OEE MES style)

ATT&CK: T1190

Detects HTTP requests containing directory traversal sequences targeting local files, consistent with path traversal exploitation such as CVE-2026-8464 in Golem OEE MES. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Possible Path Traversal Attempt Against Web Application
id: 3ca0ddce-9090-5457-a1f6-263e66b2a371
status: experimental
description: 'Detects HTTP requests containing directory traversal sequences (raw
  or URL-encoded) that attempt to escape the web root and read arbitrary files from
  the underlying operating system.

  This pattern matches the behaviour described in CVE-2026-8464 affecting Golem OEE
  MES, where an unauthenticated attacker on the local network could manipulate request
  paths to read sensitive files.

  '
references:
- https://cert.pl
logsource:
  category: webserver
detection:
  selection_raw:
    cs-uri-query|contains:
    - ../
    - ..\\
  selection_encoded:
    cs-uri-query|contains:
    - '%2e%2e%2f'
    - '%2e%2e/'
    - ..%2f
    - '%2e%2e%5c'
    - ..%5c
  filter:
    cs-uri-query|contains:
    - /assets/../
    - /static/../
  condition: (selection_raw or selection_encoded) and not filter
falsepositives:
- Legitimate applications using relative path references in query strings for asset
  versioning
- Vulnerability scanners or penetration testing tools performing authorized security
  assessments
level: medium
tags:
- attack.t1190
- attack.initial_access
author: Vorant
```

### HTTP Request Attempting to Read Sensitive OS Files via Traversal

ATT&CK: T1190

Detects HTTP requests whose path traversal sequences target well-known sensitive OS configuration or credential files, indicating likely exploitation of a path traversal vulnerability such as CVE-2026-8464. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: HTTP Request Attempting to Read Sensitive OS Files via Traversal
id: ee0f4209-bfdb-5c5e-91ff-b152e92f3218
status: experimental
description: 'Detects HTTP requests combining directory traversal sequences with references
  to sensitive operating system files (e.g. passwd, shadow, web.config, boot.ini,
  SAM hive paths).

  This behaviour is consistent with exploitation of path traversal vulnerabilities
  in web-exposed industrial software such as Golem OEE MES (CVE-2026-8464), where
  an attacker reads arbitrary OS files through manipulated request paths.

  '
references:
- https://cert.pl
logsource:
  category: webserver
detection:
  selection_traversal:
    cs-uri-query|contains:
    - ../
    - ..%2f
    - '%2e%2e%2f'
  selection_target:
    cs-uri-query|contains:
    - etc/passwd
    - etc/shadow
    - win.ini
    - boot.ini
    - web.config
    - system32/config
    - .ssh/id_rsa
  condition: selection_traversal and selection_target
falsepositives:
- Authorized penetration testing or vulnerability scanning against the web application
level: high
tags:
- attack.t1190
- attack.initial_access
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://cert.pl/en/posts/2026/06/CVE-2026-8464

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/acb34203-cc4e-554b-8830-6d827b229d03/golem-oee-mes-hit-by-path-traversal-flaw.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup