CISA Warns of Critical Vulnerabilities in EPICS Base Affecting Industrial Control Systems
CISA has issued an advisory detailing multiple critical vulnerabilities in EPICS Base, versions prior to 7.0.11, posing significant risks to industrial control systems.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has released a critical advisory concerning several vulnerabilities discovered in EPICS Base, a widely used software framework for managing industrial control systems (ICS). The affected versions are prior to 7.0.11, with specific attention drawn to CVE-2026-114595, CVE-2026-114596, and CVE-2026-114597. These vulnerabilities, identified by CISA and the EPICS Community, carry a CVSS v3.1 base score of 9.8, classifying them as 'Critical'.
The vulnerabilities stem from fundamental programming flaws, including integer overflows or wraparound issues, improper handling of length parameters in network messages, and type confusion errors. Specifically, CVE-2026-114595 involves an integer overflow during network request processing, leading to incorrect memory allocation. This can result in memory corruption, denial-of-service conditions, or even remote code execution if an attacker can supply malicious data.
CVE-2026-114596 addresses an improper validation of message length values during protocol parsing. This flaw can trigger an integer overflow, leading to an out-of-bounds memory write. Successful exploitation of this vulnerability can cause process instability or a denial-of-service condition, disrupting critical operations. The CVSS v3.1 score for this vulnerability is rated as 'High' at 8.2.
Another critical vulnerability, CVE-2026-114597, arises from insufficient validation of element or length values within network messages. This allows an application to read beyond the boundaries of an allocated buffer, potentially leading to denial of service and the disclosure of adjacent memory contents. This vulnerability is also rated as 'High' with a CVSS v3.1 score of 7.5.
These vulnerabilities are particularly concerning given the widespread use of EPICS Base in critical infrastructure sectors, including critical manufacturing. The software is deployed globally, making a broad range of industrial environments susceptible to attack. The potential impacts range from operational disruption and denial of service to more severe outcomes like information disclosure and arbitrary code execution, which could allow attackers to gain control over industrial processes.
The EPICS Community has already released updates to address these issues. Affected users are strongly urged to update to EPICS Base release 7.0.11 or later. Mitigation guidance and links to the relevant patches can be found on the epics-base GitHub repositories. For further assistance, users are advised to contact the EPICS Controls team via their support channels.
CISA has added these vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, emphasizing the immediate threat they pose. Organizations are encouraged to review CISA's advisory and implement the recommended mitigations promptly to protect their systems from potential exploitation. The agency stresses the importance of timely patching and robust security practices within operational technology (OT) environments.
This advisory serves as a critical reminder of the ongoing security challenges facing industrial control systems. The interconnected nature of modern infrastructure means that vulnerabilities in foundational software like EPICS Base can have far-reaching consequences, underscoring the need for continuous vigilance and proactive security management in critical sectors.