Four EPICS Base flaws patched, one scored CVSS 9.8
Original title: Long-Hidden Flaws Patched in EPICS Research Facility Control Software
Base 7.0.10 and earlier is affected; 7.0.11 is the fix, and CISA reports no public exploitation.
CISA disclosed four vulnerabilities in EPICS Base, the core of control software used at large research facilities. All can be triggered without authentication by network data on Channel Access or pvAccess. The most severe, CVE-2026-114595, can corrupt memory and possibly enable remote code execution, while the others can crash processes or leak nearby memory. Causal Security’s Cipher system found them; maintainers merged patches after a June 9 notification, and code execution was not demonstrated.
Unconfirmed: Remote code execution is assessed as possible but was not turned into a working exploit.
- Affected releases are EPICS Base 7.0.10 and earlier; update to 7.0.11.
- Services typically listen on TCP 5064 or TCP 5075.
- CVE-2026-114596 is CVSS 8.2; the two others are CVSS 7.5.
- Cipher confirmed an out-of-bounds heap write and crash, not a working exploit.
- Causal says the bugs are about 14.5 to 31.5 years old.
Impact: Process crash, memory leak, or possible remote code execution
| Product | Affected | Fixed in |
|---|---|---|
| EPICS Base | 7.0.10 and earlier | 7.0.11 |
- 1.Update EPICS Base to version 7.0.11.
- 2.Restrict network access to Channel Access on TCP 5064 and pvAccess on TCP 5075.
- Products
- EPICS Base
- Organizations
- CISACausal Security
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-114595 | Integer overflow in EPICS Base network request processing | 9.3 | <1% | PoC ×2 | |
CVE-2026-114596+2 related CVEs | Integer overflow in EPICS Base protocol parsing through 7.0.10 | 8.8 group max | — |
From the original article
3 min read at securityweek.com
Four EPICS Base flaws found by an autonomous system could let attackers crash processes at particle accelerators and fusion labs. The post Long-Hidden Flaws Patched in EPICS Research Facility Control Software appeared first on SecurityWeek.
By Eduard Kovacs · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.