Answer Brief
CISA released an ICS advisory warning of four vulnerabilities in EPICS Base release 7.0.10 and prior. Successful exploitation could allow an attacker to cause a denial-of-service condition, corrupt memory, disclose sensitive information, or potentially execute arbitrary code across worldwide critical manufacturing deployments. Users are advised to update to release 7.0.11.
Signal Timeline
A quick visual path for analysts before reading the full brief.
- 1
CISA issues ICS Advisory ICSA-26-300-01 regarding vulnerabilities in EPICS Base
Executive Summary: CISA released an ICS advisory warning of four vulnerabilities in EPICS Base release 7.0.10 and prior. Successful exploitation could allow an attacker to cause a denial-of-service condition, corrupt memory, disclose sensitive information, or potentially execute arbitrary code across worldwide critical manufacturing deployments. Users are advised to update to release 7.0.11.
Why It Matters
The Cybersecurity and Infrastructure Security Agency released advisory ICSA-26-300-01 addressing four vulnerabilities affecting EPICS Base release 7.0.10 and prior. Identified in equipment maintained by The EPICS Community, the software is deployed worldwide within the critical manufacturing sector. According to the advisory, successful exploitation of these flaws could allow an attacker to cause a denial-of-service condition, corrupt memory, disclose sensitive information, or potentially execute arbitrary code.
The most severe flaw documented is CVE-2026-114595, categorized as CWE-190 (Integer Overflow or Wraparound). For CVE-2026-114595, an integer overflow during network request processing can cause memory to be allocated with an incorrect size. Subsequent handling of attacker-supplied data may result in memory corruption, denial of service, or potential remote code execution. CVE-2026-114595 carries a CVSS v3.1 base score of 9.8 (CRITICAL) and a CVSS v4.0 base score of 9.3 (CRITICAL).
Technical Signal
A second integer overflow vulnerability, CVE-2026-114596 (CWE-190), involves improper validation of message length values during protocol parsing. This flaw can trigger an integer overflow that results in an out-of-bounds memory write, causing process instability or denial of service. CVE-2026-114596 has a CVSS v3.1 base score of 8.2 (HIGH) and a CVSS v4.0 base score of 8.8 (HIGH).
The advisory also documents two additional buffer over-read flaws: CVE-2026-114597 and CVE-2026-114598. In CVE-2026-114597, associated with CWE-130 (Improper Handling of Length Parameter Inconsistency), insufficient validation of element or length values in a network message can cause the application to read beyond the bounds of an allocated buffer. This may lead to denial of service and could expose adjacent memory contents. CVE-2026-114597 received a CVSS v3.1 base score of 7.5 (HIGH) and a CVSS v4.0 base score of 8.7 (HIGH).
Operational Impact
Similarly, CVE-2026-114598 involves insufficient validation of element or length values in a network message, leading to an out-of-bounds buffer read that may cause denial of service and expose adjacent memory contents. CISA maps CVE-2026-114598 to CWE-843 (Access of Resource Using Incompatible Type ['Type Confusion']). CVE-2026-114598 has a CVSS v3.1 base score of 7.5 (HIGH) and a CVSS v4.0 base score of 8.7 (HIGH). All four vulnerabilities were credited to researcher Shubham Raj of Cipher / Causal Security.
Remediation has been made available by The EPICS Community through updates in the epics-base GitHub repositories, specifically pull requests 934 and 937 in epics-base, and pull request 109 in pvDataCPP. Affected users are instructed to update their deployments to the 7.0.11 release, or contact the EPICS Controls team for additional support.
What To Watch
In terms of defensive practices, CISA recommends that operators minimize network exposure for all control system devices to ensure they are not accessible from the internet. Remote devices and control networks should be located behind firewalls and isolated from business networks. When remote access is required, organizations are advised to use Virtual Private Networks while maintaining awareness that VPNs must be kept updated to the most current version.
CISA reports that no known public exploitation specifically targeting these vulnerabilities has been reported at the time of publication. Organizations operating critical manufacturing assets that utilize EPICS Base should evaluate their running versions and plan transitions to release 7.0.11 to mitigate network-driven memory corruption and denial-of-service risks.
Event Type: security
Importance: high
Affected Companies
- The EPICS Community
- Cipher / Causal Security
Affected Sectors
- Critical Manufacturing
Key Numbers
- CVE-2026-114595 CVSS v3.1 base score: 9.8
- CVE-2026-114595 CVSS v4.0 base score: 9.3
- CVE-2026-114596 CVSS v4.0 base score: 8.8
- CVE-2026-114597 CVSS v4.0 base score: 8.7
Timeline
- CISA issues ICS Advisory ICSA-26-300-01 regarding vulnerabilities in EPICS Base
Frequently Asked Questions
What products are affected by advisory ICSA-26-300-01?
The advisory affects The EPICS Community's EPICS Base release 7.0.10 and prior across worldwide critical manufacturing deployments.
What are the potential impacts of successful exploitation?
Successful exploitation could allow an attacker to cause a denial-of-service condition, corrupt memory, disclose sensitive information, or potentially execute arbitrary code.
Has active exploitation been reported for these EPICS Base flaws?
No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.
How can affected organizations remediate these vulnerabilities?
Affected users should update to EPICS Base release 7.0.11 via the epics-base GitHub repositories or contact the EPICS Controls team.