Summary
- Four vulnerabilities affect EPICS Base release 7.0.10 and earlier, with the most severe rated CVSS 9.8 (Critical) under version 3.1.
- Flaws include integer overflows, improper length validation, and type confusion in network message processing — all exploitable remotely without authentication.
- Successful exploitation could result in denial of service, memory corruption, sensitive information disclosure, or remote code execution.
- The EPICS Community has released version 7.0.11 as the fix; updates are available via the epics-base GitHub repositories.
- No known active exploitation of these vulnerabilities has been reported to CISA at the time of publication.
What Was Disclosed
CISA published an advisory on 27 October 2026 covering four vulnerabilities in EPICS Base, the foundational software toolkit widely used in control systems across critical manufacturing and scientific infrastructure worldwide. All four CVEs affect EPICS Base release 7.0.10 and earlier. The vulnerabilities were reported to CISA by Shubham Raj of Cipher / Causal Security.
The Vulnerabilities in Detail
CVE-2026-114595 is the most severe of the four, carrying a CVSS v3.1 score of 9.8. It involves an integer overflow in network request processing that causes memory to be allocated with an incorrect size. When attacker-supplied data is subsequently handled, the result can be memory corruption, denial of service, or potential remote code execution. The attack vector is network-based, requires no authentication, and demands no user interaction — a combination that places this at the top of any patching priority list.
CVE-2026-114596, scored 8.2 (HIGH) under CVSS v3.1, involves improper validation of message length values during protocol parsing. This triggers an integer overflow leading to an out-of-bounds memory write, with outcomes including process instability or denial of service. Like the first vulnerability, it is remotely exploitable without credentials.
CVE-2026-114597 and CVE-2026-114598 are each scored 7.5 (HIGH) under CVSS v3.1. Both involve insufficient validation of element or length values within network messages, causing the application to read beyond the bounds of an allocated buffer. The practical consequence is denial of service and the potential exposure of adjacent memory contents. CVE-2026-114598 specifically involves a type confusion weakness, where a resource is accessed using an incompatible type — a class of bug that can be difficult to detect and unpredictable in its effects.
Context and Exposure
EPICS — the Experimental Physics and Industrial Control System — is used extensively in facilities such as particle accelerators, research reactors, and industrial control environments globally. Its deployment in critical manufacturing sectors means that organisations running unpatched versions of EPICS Base may be exposing control system networks to a meaningful level of remote network risk. Because all four vulnerabilities are exploitable over the network without authentication or user interaction, the exposure is relevant anywhere EPICS Base communicates across a network boundary that is insufficiently controlled.
Patch Availability
The EPICS Community has addressed all four vulnerabilities in the 7.0.11 release, with the relevant changes published through pull requests on the epics-base and pvDataCPP GitHub repositories. Organisations that cannot immediately update are advised to apply network-level controls in the interim.
Why it matters
For CISOs overseeing operational technology or supporting facilities that use EPICS-based control systems, this advisory represents a concrete patching obligation. The combination of a CVSS 9.8 remote code execution pathway and no requirement for authentication or user interaction means that network-accessible EPICS Base instances on versions 7.0.10 and below present a material risk. The fact that no active exploitation has been reported to CISA is a narrow window, not a reason for inaction. OT environments often have long patch cycles, which makes early identification and prioritisation essential. If EPICS Base is present in your environment — directly or through a third-party system integrator — version verification and upgrade planning should begin now.
What to do now
- Identify all instances of EPICS Base in your environment and confirm the version in use; treat any deployment at or below 7.0.10 as affected.
- Update to EPICS Base 7.0.11, available via the epics-base GitHub repositories, as the primary remediation.
- Where immediate patching is not possible, restrict network access to EPICS Base systems — ensure they are not reachable from the internet and are isolated from business networks by firewalls.
- Review whether remote access to EPICS-connected systems is in place and, if so, ensure it is conducted through an up-to-date VPN solution rather than direct exposure.
- Contact the EPICS Controls team at epics-controls.org/support for guidance specific to your deployment if required.
- Report any suspected malicious activity targeting these systems to CISA for tracking and correlation.
