CVE-2026-8464: Path traversal in Neuron Soft Golem OEE MES

Synopsis

A path traversal vulnerability in Neuron Soft Golem OEE MES allows an unauthenticated attacker on the same local network or VPN segment to read arbitrary files from the server's operating system by manipulating HTTP request paths. No credentials are required to exploit this flaw, and no victim interaction is needed. Successful exploitation gives the attacker full read access to files on the host, including configuration files, credentials, and any other data the server process can reach. A patched-image rebuild at version 11.6.0 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityDetail

  The attacker must be on the same adjacent network, LAN, or VPN segment as the target server; remote internet-based access alone is not sufficient.

• AuthenticationNot required

  No credentials of any privilege level are needed; the vulnerable HTTP endpoint is exposed to unauthenticated requests.

• Victim interactionNot required

  The attacker sends crafted HTTP requests directly to the server; no user action or social engineering is involved.

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race conditions, special memory layout, or environmental factors are required.

Blast Radius

• Reads arbitrary files from the server's operating system, including application configuration files that may contain database credentials, API keys, or service account secrets.
• Reads files accessible to the server process from the broader infrastructure environment (SC:H), meaning secrets shared across connected systems may also be exposed.
• Confidentiality of all data stored in files reachable by the server process is fully compromised; there is no integrity or availability impact from this vulnerability directly.