A critical flaw in EPICS Base, the core of the open-source EPICS control system toolkit, could let an unauthenticated attacker on the network corrupt memory and potentially run code, according to a CISA advisory published October 27. It is one of four bugs in EPICS Base 7.0.10 and earlier, all reached through network messages and all fixed in release 7.0.11.
EPICS is best known from particle accelerators and other large research facilities. CISA lists it as deployed worldwide in the critical manufacturing sector. The flaws were reported to CISA by Shubham Raj of Cipher / Causal Security.
One network request away from memory corruption
The four issues, ordered by severity:
- CVE-2026-114595 (CVSS 3.1: 9.8, CVSS 4.0: 9.3). An integer overflow in network request processing can cause memory to be allocated with an incorrect size. Later handling of attacker-supplied data may then corrupt memory, crash the service or potentially allow remote code execution. The score reflects network access with no privileges and no user interaction required.
- CVE-2026-114596 (8.2 / 8.8). Improper validation of message length values during protocol parsing can trigger an integer overflow and an out-of-bounds write, causing process instability or denial of service.
- CVE-2026-114597 (7.5 / 8.7). Insufficient validation of element or length values in a network message can make the software read beyond the bounds of a buffer, leading to denial of service and possibly exposing adjacent memory.
- CVE-2026-114598 (7.5 / 8.7). A type confusion flaw that CISA describes in the same terms: an out-of-bounds read that may crash the process or expose adjacent memory.
CISA says no known public exploitation specifically targeting these vulnerabilities has been reported to it.
Move to EPICS Base 7.0.11
The EPICS community has published fixes in its GitHub repositories and says affected users should update to the 7.0.11 release. The relevant changes are epics-base pull request 934, pull request 937 and pvDataCPP pull request 109. Questions go to the EPICS Controls support team.
Until the upgrade is done, CISA's standard advice carries extra weight: keep control system networks off the internet, put them behind firewalls separated from business networks, and use up-to-date VPNs where remote access is unavoidable.
A flaw that needs no login and no click, only a crafted network message, makes network isolation the real line of defense. For another recent case of industrial software that trusted whoever reached it, see our report on SCADA manager commands that needed no password.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.