Summary
- CISA identified four EPICS Base weaknesses affecting version 7.0.10 and earlier.
- The most severe flaw concerns network request processing and potential code execution.
- The EPICS community recommends updating to version 7.0.11; exploitation has not been publicly confirmed.
The open-source EPICS community has released version 7.0.11 of its Base software to address four vulnerabilities in network message handling that could disrupt control processes at scientific and industrial facilities. One weakness, CVE-2026-114595, could under vulnerable conditions lead to memory corruption and potentially remote code execution. The other identified defects can cause out-of-bounds operations, crashes and availability problems.
EPICS, the Experimental Physics and Industrial Control System, provides components used to coordinate devices, sensors and processes in large technical installations. It is associated with particle accelerators and fusion research, where systems gather measurements and control complex equipment through distributed software services. EPICS Base is a foundational toolkit rather than a single standalone application, so exposure depends on how a facility has deployed the components and which interfaces are reachable.
The US Cybersecurity and Infrastructure Security Agency issued advisory ICSA-26-300-01 on 27 October for EPICS Base 7.0.10 and earlier. Its most severe entry describes an integer overflow during network request processing that may cause incorrect memory allocation. An attacker-controlled message can then trigger memory corruption as the software handles its contents. A CVSS 3.1 score of 9.8 reflects the potentially serious consequences under the scoring model; it is not evidence that a particular laboratory has been compromised.
Three related vulnerabilities concern validation of message lengths and element values. One can lead to an out-of-bounds memory write, while others may read beyond expected memory boundaries. These flaws matter in environments where process availability and predictable communication are closely linked. Even when remote execution is not achieved, a crash in a controller or data-handling process can interrupt visibility or require manual intervention, depending on local architecture and redundancy.
EPICS installations frequently combine software that communicates over a network with equipment-specific modules and application logic. Those layers may be maintained by different research groups or suppliers, and an upgrade to a common component can require compatibility testing against instrument interfaces. A vulnerability in shared protocol processing can thus propagate across many local deployments while its practical impact varies. A particle accelerator beamline using the vulnerable service in an isolated subnet is not exposed in the same way as a facility that permits broader remote access for monitoring or integration.
A scientific instrument can appear in a facility inventory without the precise EPICS libraries incorporated into its controller or analysis computer. That makes tracking the Base version and the reachable components important during remediation. An accurate inventory has to connect the Base version with running processes and reachable interfaces. The advisory identifies memory-handling failures, but does not show that safety functions were defeated or that malicious commands reached physical equipment. The confirmed remedy is the community’s updated release, while individual facilities remain responsible for evaluating installation and validation in their own configurations.
In a research facility, safety and process control are not necessarily identical. A scientific application may be critical to experiments without directly controlling a safety interlock; alternatively, a failure can affect commissioning or planned operating periods. Facility operators can establish exposure by mapping affected EPICS services to equipment and the networks that can reach them, including remote-control or diagnostic interfaces. A vulnerable version installed in an isolated test environment has a different exposure from a network-accessible production component.
The EPICS community has provided fixes in version 7.0.11, and administrators should evaluate dependencies and compatibility before applying them to controlled environments. CISA reports no publicly known exploitation specifically targeting the vulnerabilities. The flaws were identified by Causal Security’s Cipher research system. That provenance identifies the discovery method, but does not establish that autonomous testing can uncover every flaw in comparable industrial codebases. The EPICS Base upgrade remains the verified remedy for these specific findings.
