Skip to content
Critical Vulnerabilities Found in EPICS Base Control Software

Critical Vulnerabilities Found in EPICS Base Control Software

First seen 28 Oct 2026, 12:09 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 28, 2026 at 13:09 UTC
  • •Four critical vulnerabilities in EPICS Base disclosed by CISA on October 27, 2026.
  • •CVE-2026-114595 has a CVSS score of 9.8, allowing potential remote code execution.
  • •No public exploitation has been reported; users should update to version 7.0.11.

Four vulnerabilities in EPICS Base, crucial for control systems in scientific facilities, were disclosed by CISA on October 27, 2026. The flaws, affecting versions 7.0.10 and earlier, could allow attackers to crash processes or potentially execute code remotely. The most severe vulnerability, CVE-2026-114595, has a CVSS score of 9.8 and involves an integer overflow that can lead to memory corruption. Other vulnerabilities include CVE-2026-114596 (8.2), CVE-2026-114597 (7.5), and CVE-2026-114598 (7.5), all related to network communication protocols. These vulnerabilities can be exploited without authentication, requiring only network access to vulnerable EPICS services. Causal Security's Cipher system discovered the flaws in under four hours, and no public exploitation has been reported so far. Users are urged to update to EPICS Base version 7.0.11 to mitigate risks.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-27
CISA discloses vulnerabilities in EPICS Base
CISA published advisory ICSA-26-300-01 detailing four vulnerabilities affecting EPICS Base 7.0.10 and earlier.
SecurityWeek
2026-10-27
EPICS Base version 7.0.11 released
The maintainers of EPICS released version 7.0.11 to patch the disclosed vulnerabilities.
Causal Security
2026-10-27
CVE-2026-114595 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-27
CVE-2026-114597 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-27
CVE-2026-114598 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-27
CVE-2026-114596 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-28
Security articles published
Both SecurityWeek and Causal Security published articles detailing the vulnerabilities and their implications.
SecurityWeek

More articles in this cluster (4)

Following this threat?

Track CVE-2026-114595 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (10)

1 / 3

Common questions

Which versions of EPICS Base are affected?
EPICS Base versions 7.0.10 and earlier are affected by the vulnerabilities.
What should I do to protect my systems?
Update to EPICS Base version 7.0.11 to mitigate the vulnerabilities.
Have these vulnerabilities been exploited in the wild?
No public exploitation of these vulnerabilities has been reported to CISA.