CISA published an advisory on 27 October 2026 for EPICS Base, the open-source control system framework. It covers four vulnerabilities in network message handling. These could allow denial of service, memory corruption, information disclosure, or possibly remote code execution. The most severe is an integer overflow in network request processing. Affected products and IDs EPICS Base 7.0.10 and earlier. CVE-2026-114595 (CVSS 3.1 9.8), CVE-2026-114596, CVE-2026-114597 and CVE-2026-114598. CISA ICSA-26-300-01. Exploitation status Not on CISA KEV, and CISA's advisory reports no exploitation. Why it matters to OT operators EPICS runs accelerators, research facilities and some industrial control applications, and can be attacked over the network without authentication. Update to EPICS Base 7.0.11 and keep control networks isolated from business and internet traffic. Sources CISA ICSA-26-300-01, 27 Oct 2026 Source dates: 27 Oct 2026.
CISA published an advisory on 27 October 2026 for EPICS Base, the open-source control system framework. It covers four vulnerabilities in network message handling. These could allow denial of service, memory corruption, information disclosure, or possibly remote code execution. The most severe is an integer overflow in network request processing. Affected products and IDs EPICS Base 7.0.10 and earlier. CVE-2026-114595 (CVSS 3.1 9.8), CVE-2026-114596, CVE-2026-114597 and CVE-2026-114598. CISA ICSA-26-300-01. Exploitation status Not on CISA KEV, and CISA's advisory reports no exploitation. Why it matters to OT operators EPICS runs accelerators, research facilities and some industrial control applications, and can be attacked over the network without authentication. Update to EPICS Base 7.0.11 and keep control networks isolated from business and internet traffic. Sources CISA ICSA-26-300-01, 27 Oct 2026 Source dates: 27 Oct 2026.