EPICS Base 7.0.11 patches four network flaws, no known exploitation
October 28: SecurityWeek adds no known public exploitation, unauthenticated Channel Access and pvAccess access, typical ports, a June 9 notification, and no demonstrated code execution.
EPICS Base through 7.0.10 has four unauthenticated network flaws fixed in 7.0.11, and CISA reports no public exploitation.
CISA says EPICS Base 7.0.10 and earlier, used at large scientific facilities and in Critical Manufacturing worldwide, has four flaws reachable without authentication over Channel Access or pvAccess. CVE-2026-114595, an integer overflow, scores CVSS 3.1 9.8 and CVSS 4.0 9.3 and can corrupt memory, deny service, or potentially run code. Three related length-validation bugs can crash processes or disclose adjacent memory. Causal Security’s Cipher agent found and validated the issues; maintainers merged fixes after a June 9 notification, and code execution was not demonstrated. CISA reports no public exploitation and advises updating to 7.0.11. The Register says affected version ranges were not stated, while CISA and SecurityWeek specify 7.0.10 and earlier.
- CVE-2026-114595 is CVSS 3.1 9.8 and CVSS 4.0 9.3.
- CVE-2026-114596 is CVSS 8.2; the other two are CVSS 7.5.
- Services typically listen on TCP 5064 or TCP 5075.
- Cipher validated the four issues in three hours and 49 minutes.
- Causal says the bugs are about 14.5 to 31.5 years old.
- EPICS is used in about 90 major projects, The Register says.
What each outlet adds
beyond the shared facts- CISA AdvisoriesNames Critical Manufacturing, worldwide use, and both CVSS scores for the critical flaw.
- The RegisterCipher runtime, about 90 projects, and network access as a prerequisite.
- SecurityWeekNo public exploitation, ports, June 9 notice, and estimated bug ages.
- Vendors
- The EPICS Community
- Products
- EPICS Base
- AI models
- Cipher
Coverage
oldest first · one row per article · UTC- · 3d ago
CISA AdvisoriesFirst report
EPICS Base 7.0.10 and earlier: network flaws up to CVSS 9.8
Update to EPICS Base 7.0.11; the worst flaw can corrupt memory and may allow remote code execution.
- · 3d ago
The Register · Security
EPICS Base 7.0.11 fixes four severe bugs, one rated 9.8
Causal Security’s Cipher agent reported the flaws in under four hours; CISA warns of crashes, memory disclosure or possible code execution.
- · 2d ago
SecurityWeek
Four EPICS Base flaws patched, one scored CVSS 9.8
Base 7.0.10 and earlier is affected; 7.0.11 is the fix, and CISA reports no public exploitation.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-114595 | Integer overflow in EPICS Base network request processing | 9.3 | <1% | PoC ×2 | |
CVE-2026-114596+2 related CVEs | Integer overflow in EPICS Base protocol parsing through 7.0.10 | 8.8 group max | — |