CISA published ICS advisory ICSA-26-300-01 on 27 October 2026 for EPICS Base from the EPICS community, listing four CVEs in EPICS Base release 7.0.10 and prior.

According to CISA, CVE-2026-114595 (CVSS 3.1 9.8, CVSS 4.0 9.3, Critical) is an integer overflow in network request processing that can cause memory to be allocated with an incorrect size, and subsequent handling of attacker-supplied data may result in memory corruption, denial of service or potential remote code execution; CVE-2026-114596 (CVSS 3.1 8.2, CVSS 4.0 8.8) is improper validation of message length values during protocol parsing that can trigger an integer overflow and an out-of-bounds memory write, causing process instability or denial of service; and CVE-2026-114597 and CVE-2026-114598 (CVSS 3.1 7.5, CVSS 4.0 8.7) are insufficient validation of element or length values in a network message that can cause reads beyond an allocated buffer, leading to denial of service and possible exposure of adjacent memory.

CISA says the EPICS community has made updates available in the epics-base GitHub repositories and users should update to the 7.0.11 release; EPICS Base R7.0.11 is published on GitHub, dated 27 October.

CISA says no known public exploitation specifically targeting these vulnerabilities has been reported to it, lists the product as deployed worldwide in critical manufacturing, and credits Shubham Raj of Cipher / Causal Security with reporting the flaws.

Primary: CISA advisory.