The facts

  1. CVE-2026-114595 has a CVSS v3.1 score of 9.8. It can corrupt memory, crash a process or potentially allow remote code execution. [1]

  2. The other flaws are CVE-2026-114596, CVE-2026-114597 and CVE-2026-114598. CISA describes memory-write, read and type-handling problems. [1]

  3. Causal Security told SecurityWeek that exploitation requires network access to vulnerable EPICS services but no authentication or user interaction. Its testing demonstrated memory corruption and crashes, not a working code-execution exploit. [3]

  4. No public exploitation has been reported to CISA. Internet-exposed deployment numbers are unverified. [1][3]

  5. CISA recommends restricting network exposure and isolating control networks. EPICS maintainers warn that older clients and support modules need compatibility testing with 7.0.11. [1][2]

Sources

References support the numbered facts above. Source checks: 29 Oct 2026, 03:14 UTC.

  1. EPICS Base: ICSA-26-300-01

    US Cybersecurity and Infrastructure Security Agency · Primary source · 27 Oct 2026

    Full advisory retrieved and read through public HTTPS.

  2. EPICS 7.0.11 release and compatibility guidance

    EPICS Community · Primary source · 28 Oct 2026

    Release page dates the source archive to 26 October and the page to 28 October.

  3. Long-Hidden Flaws Patched in EPICS Research Facility Control Software

    SecurityWeek · Reporting · 28 Oct 2026

    Wired Business Media reporting includes its own interview with Causal Security; independent from CISA and EPICS.

Report a factual error