EPICS Base 7.0.11 fixes four severe bugs, one rated 9.8
Original title: AI 'hacker' finds 4 severe bugs in popular industrial control software in under 4 hours
Causal Security’s Cipher agent reported the flaws in under four hours; CISA warns of crashes, memory disclosure or possible code execution.
An autonomous agent from Causal Security found four previously unknown flaws in EPICS Base, the open-source toolkit used to control large scientific facilities. The critical issue, CVE-2026-114595, is a CVSS 9.8 integer overflow that can cause an attacker-controlled out-of-bounds heap write and potentially remote code execution. Three high-severity bugs can crash controller processes, read out of bounds or expose adjacent memory. CISA said exploitation could deny service, corrupt memory, disclose information or run code, and operators are told to update to 7.0.11. Reaching the services on a facility control network is a prerequisite.
Unconfirmed: Remote code execution is described as potential, and no real-world exploitation is reported.
- CVE-2026-114596 is rated 8.2 for improper message-length validation and an out-of-bounds write.
- CVE-2026-114597 and CVE-2026-114598 are both rated 7.5.
- Cipher investigated and validated the four issues in three hours and 49 minutes, Causal Security said.
- EPICS is used in about 90 major scientific, university and industrial projects, the report says.
- Fixes are in EPICS Base 7.0.11; affected version ranges are not stated.
Impact: Possible remote code execution, crashes or memory disclosure on controllers
| Product | Affected | Fixed in |
|---|---|---|
| EPICS Base | — | 7.0.11 |
- 1.Update EPICS Base to version 7.0.11.
- 2.Limit network reachability of EPICS services on facility control networks.
- Products
- EPICS Base
- AI models
- Cipher
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-114595 | Integer overflow in EPICS Base network request processing | 9.3 | <1% | PoC ×2 | |
CVE-2026-114596+2 related CVEs | Integer overflow in EPICS Base protocol parsing through 7.0.10 | 8.8 group max | — |
From the original article
3 min read at theregister.comOne critical, three high-severity EPICS bugs could disrupt research experiments
By Jessica Lyons · theregister.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.