Overview

On 27 October 2026 CISA published ICSA-26-300-01 (Revision 1) for EPICS Base, the open-source control system toolkit used at accelerators, telescopes, fusion experiments and some industrial sites. The advisory covers release 7.0.10 and prior and lists four CVEs, CVE-2026-114595 to CVE-2026-114598. CISA lists the sector as Critical Manufacturing, deployed worldwide. The fix is EPICS Base 7.0.11. In our assessment the sector listing understates the installed base, since EPICS is common in research facilities.

All four flaws are network-reachable with no privileges or user interaction, per the published vectors.

The four CVEs

CVECWECVSS v3.1CVSS v4.0
CVE-2026-114595CWE-190, integer overflow9.8 Critical9.3 Critical
CVE-2026-114596CWE-190, integer overflow8.2 High8.8 High
CVE-2026-114597CWE-130, length parameter inconsistency7.5 High8.7 High
CVE-2026-114598CWE-843, type confusion7.5 High8.7 High

CVE-2026-114595 is an integer overflow in network request processing that causes memory to be allocated with the wrong size. Later handling of attacker-supplied data can lead to memory corruption, denial of service or potential remote code execution. The v3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

CVE-2026-114596 is a message-length validation failure during protocol parsing that triggers an overflow and an out-of-bounds write. Its v3.1 vector has no confidentiality impact (C:N/I:L/A:H). CVE-2026-114597 and CVE-2026-114598 both describe insufficient validation of element or length values, producing reads past an allocated buffer, with denial of service and possible exposure of adjacent memory. Both are availability-only in the v3.1 vector.

Do the scores conflict?

We checked CISA’s advisory, the CVE record (CNA is CISA’s ICS-CERT) and the OpenCVE mirror of NVD data. They agree: 9.8 and 9.3 for CVE-2026-114595, and 7.5 and 8.7 for CVE-2026-114598. NVD showed “Awaiting Analysis” for CVE-2026-114595 when we looked, with CISA’s scores listed as the secondary source. The discrepancies were in press coverage: The Register omitted the CVSS version for three CVEs, and one aggregator said CISA gave no score for CVE-2026-114598, which is wrong. Use the CISA figures above.

The CNA record carries an SSVC assessment for CVE-2026-114595: exploitation none, automatable yes, technical impact total. OpenCVE showed no CISA KEV listing; we did not open the KEV catalog itself.

Which protocol is affected?

CISA’s text says “network request processing” and “network message” and does not name Channel Access (CA) or pvAccess (PVA). The linked fixes give a hint. epics-base pull request 934, “RSRV message validation,” tightens checks on incoming CA messages in the RSRV server, including overflow in the extended message size and consistency between the msgsize, dtype and count header fields. pvDataCPP pull request 109, “Check deserialization,” adds type checks and a recursion limit when deserializing PVA data. Both were written by Michael Davidsaver and merged in July and August 2026.

Our assessment is that the flaws span both CA (TCP 5064, UDP 5064 for search) and PVA (TCP/UDP 5075 and 5076), but no source we opened maps individual CVEs to protocols, so confirm against the 7.0.11 release notes. Note also that CISA lists pull request 937, which is a SECURITY.md policy file and not a code fix.

Operational impact

CA and PVA have no authentication in a default deployment. Anyone who can reach an IOC (input/output controller) on those ports can already read and, unless access security rules intervene, write process variables. These flaws add memory corruption on top of that exposure. For a process owner, the realistic near-term impact is a crashed IOC and lost monitoring or control of the attached I/O. Remote code execution on an IOC, which often runs on a Linux or RTEMS host close to Purdue Level 1 and 2, is possible per the CVE text but no exploit is described in any source we opened.

Exploitation status

CISA states: “No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.” We found no evidence of exploitation as of 1 November 2026 in the CISA advisory, the CVE record, OpenCVE or The Register.

Attribution: single-source caution

CISA credits Shubham Raj of Cipher / Causal Security. The Register reports that Causal Security says its AI agent, also called Cipher, found all four flaws in 3 hours 49 minutes. That is a vendor claim reported by one outlet (an aggregator repeated it), and we could not verify it. It does not change the technical risk.

Remediation

  1. Upgrade to EPICS Base 7.0.11. The GitHub release is dated 27 October and the tarball was built on 26 October. Use the official base-7.0.11.tar.gz; GitHub’s auto-generated archives omit the PVA submodules.
  2. Rebuild and redeploy every IOC, gateway and tool linked against Base. These are static or locally built binaries, so updating one host does not cover the rest.
  3. Block CA and PVA ports at zone boundaries. Do not expose 5064, 5065, 5075 or 5076 to business networks or the internet.
  4. Where patching waits, restrict client sources with firewall rules. This limits exposure but does not remove the parsing flaws.

Sources

Tags
EPICSEPICS BaseChannel AccesspvAccessinteger overflowCWE-190CVE-2026-114595ICSA-26-300-01