EPICS Base: AI agent finds 4 severe bugs incl. critical RCE in industrial control software (CVE-2026-114595)
Severity: critical · Patch status: patched · Since 2026-10-27 · CVE-2026-114595, CVE-2026-114596, CVE-2026-114597, CVE-2026-114598
Causal Security's autonomous AI agent Cipher discovered four previously unknown vulnerabilities in EPICS Base, the open source SCADA toolkit used by ~90 major scientific facilities including Argonne's Advanced Photon Source and ITER's fusion reactor control system. The flaws are a critical CVSS 9.8 integer overflow (CVE-2026-114595) enabling attacker-controlled out-of-bounds heap write and potential RCE; an 8.2 improper message-length validation flaw (CVE-2026-114596) causing OOB write and controller crash; and two 7.5 highs (CVE-2026-114597 insufficient bounds checking, CVE-2026-114598 type confusion) enabling OOB reads, crashes, DoS and adjacent memory disclosure. CISA issued an advisory. Exploitation requires network reach to EPICS services but not deep OT expertise. Fixes are in EPICS Base 7.0.11.
What to do
- Update EPICS Base to version 7.0.11 immediately
- Segment/isolate control networks running EPICS from other systems and restrict access to EPICS services
- Review exposure of EPICS controllers across network boundaries and firewall OT traffic
- Monitor controllers for crashes or anomalous network traffic
- Assess operational risk to experiments and plan for potential downtime
Fixed versions
Sources
All live incidents on Threat Watch
