VulnerabilityDeferred

CVE-2026-8464

Golem OEE MES is vulnerable to an unauthenticated path traversal flaw.

HIGH 8.3EPSS 0.20%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.20%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Golem OEE MES is vulnerable to an unauthenticated path traversal flaw. This vulnerability allows an attacker in the same local network to read arbitrary files from the server's operating system by manipulating HTTP request paths. This issue has been fixed in version 11.6.0

CVSS 4.0: 8.3 HIGHCVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.20% probability · 11th percentile
CISA KEV: Not listed
Weakness: CWE-22
Source: cvd@cert.pl

References

https://cert.pl/posts/2026/06/CVE-2026-8464
https://www.neuron.com.pl/mes-help/mes-download.html

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.