Patches Released for Four Serious Flaws in EPICS Base Control Software
Four vulnerabilities in EPICS Base, the central component of the open source toolkit used at particle accelerators and fusion experiments, have been fixed with version 7.0.11. The most severe, CVE-2026-114595 (CVSS 9.8), is an integer overflow that could possibly enable remote code execution, but no public exploitation has been reported to CISA. Facilities running EPICS Base 7.0.10 or earlier should update.
What happened
Cipher, an autonomous security research system from Causal Security, found four flaws in EPICS Base, software used in control systems at particle accelerators and fusion experiments. The most severe is rated CVSS 9.8 and could possibly enable remote code execution. Patches have already been released, SecurityWeek reports.
Why it matters
According to Causal Security, an attack could interrupt particle beams, disrupt experiments, cause loss of monitoring data and expensive shutdowns of critical research equipment. ITER's fusion reactor control system is based on EPICS, and Argonne National Laboratory's Advanced Photon Source makes heavy use of the software.
What to do
Update EPICS Base to version 7.0.11, as CISA recommends. Check whether EPICS services (TCP ports 5064 and 5075) are exposed and restrict access to the facility's internal network.
For the technical team
- CVE
- CVE-2026-114595
- Affected
- EPICS base · EPICS Base 7.0.10 and earlier. Other CVEs: CVE-2026-114596 (CVSS 8.2, out-of-bounds write leaving the process unstable or causing DoS), CVE-2026-114597 (CVSS 7.5, out-of-bounds read that can crash the application and leak data from nearby memory), CVE-2026-114598 (CVSS 7.5, type confusion triggered by malformed network data, leading to DoS).
- Exploitation
- No public exploitation reported to CISA. RCE was not achieved: Cipher demonstrated the attacker-controlled out-of-bounds heap write and process crash using AddressSanitizer but did not pursue a functional RCE exploit, according to Causal Security co-founder Shubham Raj. A brief Censys check identified potential candidates based on exposed ports, but none could be verified as EPICS; the number of internet-facing deployments is unknown.
- Fix
- Update to EPICS Base 7.0.11, as CISA recommends. Maintainers were notified on June 9 and merged patches in July and August.
- Vector
- Flaws in EPICS Base's handling of the Channel Access and pvAccess network protocols. All four can be triggered without authentication or user interaction; an attacker needs network access to the vulnerable EPICS services, typically TCP 5064 (Channel Access) or 5075 (pvAccess), through an exposed service or the facility's internal network. The most severe, CVE-2026-114595 (CVSS 9.8), is an integer overflow during network request processing that causes a wrongly sized memory allocation; processing attacker-supplied data afterwards can corrupt memory, trigger DoS or possibly enable remote code execution, according to CISA.
- More details
- Found by Cipher, Causal Security's autonomous system, in roughly 3 hours and 49 minutes, starting with no knowledge of EPICS and no attack techniques designed for scientific control systems; no human directed the first phase of the analysis. A review of the code history shows the flaws are between approximately 14.5 and 31.5 years old. CISA disclosed the issues in an advisory published on Tuesday. Causal's research also led to disclosures in Grid Protection Alliance's openPDC and openHistorian and in the FreeRTOS-Plus-TCP embedded networking stack.
Timeline
SecurityWeek reports that patches for the four EPICS Base flaws have now been released.
First report: the AI agent's maker announces the four flaws, including CVE-2026-114595.
Sources 2 sources
- @IntCyberDigest @IntCyberDigest
- Long-Hidden Flaws Patched in EPICS Research Facility Control Software SecurityWeek
