CISA Warns of Four EPICS Base Vulnerabilities, Including Critical RCE Flaw
TL;DR
On October 27, CISA published advisory ICSA-26-300-01 on four EPICS Base vulnerabilities. The worst, CVE-2026-114595, scores 9.8 on CVSS v3 and 9.3 on CVSS v4. It could let a remote attacker run code with no login.
Four memory bugs in EPICS Base 7.0.10 and earlier can be triggered over the network without authentication. One may lead to remote code execution, while the rest cause crashes or memory leaks. The fix is in EPICS Base 7.0.11.
Why It Matters
EPICS is an open-source industrial control system toolkit. Labs use it to run particle accelerators, telescopes and light sources. According to Wikipedia, “over 50 large science institutions worldwide” rely on it, including Argonne’s Advanced Photon Source and LIGO.
A crash in this industrial control system software can halt experiments or beam operations. Moreover, CISA’s assessment marks all four flaws as “Automatable.”
How the Attack Works
Critical integer overflow
CISA’s record for CVE-2026-114595 explains that “an integer overflow in network request processing can cause memory to be allocated with an incorrect size.” As a result, attacker data “may result in memory corruption, denial of service, or potential remote code execution.”
High severity flaws
CVE-2026-114596 (CVSS v4 8.8) is another integer overflow that causes an out-of-bounds write. Meanwhile, CVE-2026-114597 and CVE-2026-114598 (both 8.7) let a crafted network message “read beyond the bounds of an allocated buffer.” That could crash the process and “expose adjacent memory contents.”
Affected Versions
These EPICS Base vulnerabilities affect release 7.0.10 and all earlier versions.
Patch and Mitigation
The EPICS community advises, “Affected users should update to the 7.0.11 release.” Fixes also landed in the epics-base and pvDataCPP GitHub repositories.
Until you upgrade, the EPICS Base vulnerabilities remain reachable over the network. So, keep control networks isolated from the internet and business networks. Shubham Raj of Cipher / Causal Security reported the bugs. So far, no exploitation has been confirmed, and none of the flaws are in CISA’s KEV catalog.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
