Four vulnerabilities in EPICS Base could allow attackers to crash processes in control systems used at particle accelerators, fusion experiments and other large research facilities. One flaw could potentially lead to code execution.
CISA disclosed the issues in an advisory published on Tuesday, saying they impact EPICS Base 7.0.10 and earlier. The agency recommends updating to version 7.0.11.
The vulnerabilities were discovered by Cipher, an autonomous security research system made by Causal Security.
EPICS is an open source software toolkit that scientific facilities rely on to build their control systems, and EPICS Base is its central component. According to Causal, ITER’s fusion reactor control system is based on EPICS, and the Advanced Photon Source at Argonne National Laboratory makes heavy use of it.
The most severe of the bugs is CVE-2026-114595 (CVSS score of 9.8), an integer overflow that can occur when network requests are processed. According to CISA, it can lead to a wrongly sized memory allocation, and processing attacker-supplied data afterwards could corrupt memory, trigger DoS, or possibly enable remote code execution.
Exploiting CVE-2026-114596 (CVSS score of 8.2) can cause an out-of-bounds write that leaves the process unstable or causes DoS. CVE-2026-114597 (CVSS score of 7.5) is an out-of-bounds read that could crash the application and leak data from nearby memory, while CVE-2026-114598 (CVSS score of 7.5) is a type confusion issue that can be triggered with malformed network data, leading to DoS.
All four bugs are tied to the handling of Channel Access and pvAccess, the protocols EPICS uses for network communication. Shubham Raj, co-founder of Causal Security, explained to SecurityWeek what an attack would require.
“All four can be triggered without authentication or user interaction. An attacker needs network access to the vulnerable EPICS services, typically on TCP 5064 (Channel Access) or 5075 (pvAccess). This could be through an exposed service or access to a facility’s internal network,” he said.
Attacks could disrupt costly experiments
Regarding the potential operational consequences of the vulnerabilities, Raj explained, “Operationally, this could potentially mean interrupted particle beams, disrupted experiments, lost monitoring data, or expensive shutdowns of critical research equipment (by abusing remote code execution).”
Code execution has not actually been achieved, though. “Cipher demonstrated the attacker-controlled out-of-bounds heap write and process crash using AddressSanitizer,” Raj said. After that write was confirmed, he did not pursue a functional RCE exploit.
The number of internet-facing EPICS deployments is also unknown. Raj said a brief Censys check identified potential candidates based on exposed ports, but none could be verified as EPICS.
No public exploitation of the flaws has been reported to CISA.
The bugs were found in under four hours
According to Causal, Cipher needed roughly 3 hours and 49 minutes to identify the four vulnerabilities. It started with no knowledge of EPICS and was not given attack techniques designed for scientific control systems.
No human directed the first phase of the analysis. Afterward, the system received a single instruction to look more closely at whether the bugs could be exploited.
Cipher’s review of the code history shows the flaws are between approximately 14.5 and 31.5 years old. EPICS maintainers were notified on June 9 and merged patches in July and August.
Earlier this month, Causal’s research also led to disclosures in Grid Protection Alliance’s openPDC and openHistorian, which process power grid measurements, and in the FreeRTOS-Plus-TCP embedded networking stack.
Related: Maritime Coalition Launches Free Vulnerability Database for Ship and Port Systems
Related: Industrial Vendors Check Products for PHP2Shell Vulnerabilities
Related: Accenture, Dragos, SANS Launch $10M Initiative to Defend Small US Utilities
