What happened
The EPICS Community released an advisory identifying four critical vulnerabilities in EPICS Base releases up to 7.0.10. CVE‑2026‑114595 is an integer overflow in network request handling that can allocate an incorrect buffer size, leading to memory corruption and potential remote code execution. CVE‑2026‑114596 involves improper handling of a length‑parameter inconsistency, also resulting in memory corruption. CVE‑2026‑114597 is a type‑confusion error when accessing resources with incompatible types, which can be leveraged for arbitrary code execution. CVE‑2026‑114598 adds another integer‑wraparound flaw with similar impact. All four receive a CVSS v3.1 score of 9.8 (Critical). EPICS Base is widely deployed in critical manufacturing and other industrial control sectors worldwide. Successful exploitation could disrupt plant operations, expose sensitive process data, or allow an attacker to take control of supervisory functions.
Why it matters for trust and compliance
- These flaws highlight the control objective of maintaining an effective vulnerability‑management program—continuous monitoring, timely patching, and documented evidence of remediation are essential for audit readiness across frameworks.
- Demonstrates the need for continuous vulnerability monitoring to retain defensible audit evidence of patch status.
- Supports the control objective of timely remediation of high‑severity flaws across multiple compliance frameworks (e.g., NIST CSF, ISO 27001).
Who is affected
MANUF_IND
Recommended actions
- Upgrade all EPICS Base installations to version 7.0.11 or later from the official GitHub repository.
- Validate the version on every asset and record the remediation in your vulnerability‑management system.
- Integrate EPICS Base version checks into continuous configuration monitoring to generate audit‑ready evidence.
Details
- CVEs
- CVE-2026-114595, CVE-2026-114596, CVE-2026-114597, CVE-2026-114598