Cipher uncovers four flaws in EPICS control software

CISA disclosed four vulnerabilities in EPICS Base, the core of the EPICS control system toolkit used by facilities such as ITER’s fusion reactor and the Advanced Photon Source at Argonne National Laboratory. The flaws affect EPICS Base 7.0.10 and earlier, with a recommended update to version 7.0.11.

The issues were identified by Cipher, an autonomous security research system developed by Causal Security, and concern flaws in the Channel Access and pvAccess network protocols that EPICS uses for inter-process communications.

The four CVEs are CVE-2026-114595 (CVSS 9.8), CVE-2026-114596 (CVSS 8.2), CVE-2026-114597 (CVSS 7.5) and CVE-2026-114598 (CVSS 7.5). The most severe, CVE-2026-114595, is an integer overflow that can occur when handling network requests, potentially leading to an incorrectly sized memory allocation, memory corruption, denial of service, or remote code execution.

CVE-2026-114596 describes an out-of-bounds write that can destabilise a process or cause DoS; CVE-2026-114597 is an out-of-bounds read that could crash an application or leak memory contents; CVE-2026-114598 involves a type confusion triggered by malformed network data, with DoS potential.

All four flaws relate to Channel Access and pvAccess handling and can be triggered without authentication or user interaction, provided the attacker has network access to vulnerable EPICS services (typically TCP 5064 for Channel Access or 5075 for pvAccess).

Cipher demonstrated an attacker-controlled out-of-bounds heap write and a process crash using AddressSanitizer, but there has been no public evidence of functional remote code execution. The number of internet-facing EPICS deployments remains unknown, and no exploitation has been reported to CISA. Maintainers merged patches in mid to late 2026, following the discovery and notification by Causal Security.