--- type: "post" id: "long-hidden-flaws-patched-in-epics-research-facility-4b2236" slug: "long-hidden-flaws-patched-in-epics-research-facility-4b2236" title: "Long-Hidden Flaws Patched in EPICS Research Facility Control Software" description: "Four patched vulnerabilities in EPICS Base can reportedly be triggered without authentication or user interaction by an attacker who can reach the relevant network services." retrieval_nugget: "Four patched vulnerabilities in EPICS Base can reportedly be triggered without authentication or user interaction by an attacker who can reach the relevant network services. The finding matters to teams operating scientific control systems because the practical exposure question is network reachability, while public evidence still does not show exploitation or a working remote-code-execution exploit." published_at: "2026-10-31" updated_at: "2026-10-31" record_date: "2026-10-31" date_kind: "published_at" topics: ["security"] entities: ["EPICS Base","EPICS","Causal Security","Cipher","CISA","Channel Access","pvAccess"] related_patterns: [] novelty_label: "new_fact" what_changed: "Causal Security says all four flaws require no authentication or user interaction; it reports no exploitation to CISA and no verified exposed EPICS hosts." prior_refs: ["memory:49269c2d-0c83-8a53-a77e-9ade1edc2b39","memory:47b2cfd9-7eed-8f44-af46-cd708aeaddfe"] source_url: "https://www.securityweek.com/long-hidden-flaws-patched-in-epics-research-facility-control-software" source_urls: ["https://www.securityweek.com/long-hidden-flaws-patched-in-epics-research-facility-control-software"] schema_version: "newruntime-agent-readable-v0.2" stable_id: "post:long-hidden-flaws-patched-in-epics-research-facility-4b2236" status: "published" visuals: [] editor: {"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]} routes: {"html":"https://newruntime.com/posts/long-hidden-flaws-patched-in-epics-research-facility-4b2236/","markdown":"https://newruntime.com/posts/long-hidden-flaws-patched-in-epics-research-facility-4b2236.md","json":"https://newruntime.com/posts/long-hidden-flaws-patched-in-epics-research-facility-4b2236.json"} --- # Long-Hidden Flaws Patched in EPICS Research Facility Control Software ## Retrieval answer Four patched vulnerabilities in EPICS Base can reportedly be triggered without authentication or user interaction by an attacker who can reach the relevant network services. The finding matters to teams operating scientific control systems because the practical exposure question is network reachability, while public evidence still does not show exploitation or a working remote-code-execution exploit. ## Summary Four patched vulnerabilities in EPICS Base can reportedly be triggered without authentication or user interaction by an attacker who can reach the relevant network services. The finding matters to teams operating scientific control systems because the practical exposure question is network reachability, while public evidence still does not show exploitation or a working remote-code-execution exploit. ## What happened SecurityWeek reported that CISA disclosed four vulnerabilities affecting EPICS Base 7.0.10 and earlier, and recommended upgrading to version 7.0.11. EPICS is an open-source toolkit used to build control systems at scientific facilities; EPICS Base is its central component. Causal Security says its autonomous research system, Cipher, discovered the issues. The report identifies deployments or use at facilities including ITER's fusion reactor control system and the Advanced Photon Source at Argonne National Laboratory. The four flaws are CVE-2026-114595 through CVE-2026-114598. The most severe, CVE-2026-114595, has a CVSS score of 9.8. It is an integer-overflow issue in processing network requests that can result in an incorrectly sized memory allocation. Processing attacker-controlled data afterward could corrupt memory, cause denial of service, or potentially enable remote code execution. CVE-2026-114596, scored 8.2, is an out-of-bounds write that can destabilize a process or cause denial of service. CVE-2026-114597, scored 7.5, is an out-of-bounds read that can crash an application and disclose nearby memory. CVE-2026-114598, also scored 7.5, is a type-confusion issue triggered by malformed network data that can cause denial of service. All four issues concern handling of Channel Access and pvAccess, the protocols EPICS uses for network communication. Causal Security co-founder Shubham Raj told SecurityWeek that an attacker needs network access to a vulnerable EPICS service, typically through TCP port 5064 for Channel Access or TCP port 5075 for pvAccess. That access could come from an exposed service or from a facility's internal network. Raj said authentication and user interaction are not required. The report draws an important boundary around the demonstrated impact. Cipher showed an attacker-controlled out-of-bounds heap write and a process crash with AddressSanitizer, but did not produce a functional remote-code-execution exploit. A brief Censys check found hosts that were candidates based on exposed ports, but none could be verified as EPICS deployments. CISA had received no reports of public exploitation. Cipher reportedly found the four issues in roughly three hours and 49 minutes after starting without prior knowledge of EPICS; its review placed the underlying flaws at approximately 14.5 to 31.5 years old. Maintainers were notified on June 9 and merged patches in July and August. ## What the archive adds This is a new fact on a known story. [Our earlier Field Note on Cipher's EPICS Base findings](https://newruntime.com/posts/autonomous-ai-agent-cipher-finds-four-epics-base-15c4dc/) covered the four vulnerabilities and the availability of version 7.0.11. The new report adds the claimed unauthenticated trigger condition, relevant ports, and the limits of the available exploit and exposure evidence. ## Trend signal No supplied Pattern or assumption is genuinely specific enough to support a broader trend claim from this narrowly scoped control-system disclosure. ## Why now The disclosure follows coordinated remediation rather than an observed attack campaign: EPICS maintainers were notified on June 9 and patches were merged in July and August. CISA's advisory and SecurityWeek's report make the operational details public after version 7.0.11 became available. ## Connections to other events The archive also includes PHP2Shell patching and CISA catalog updates, but those concern different software and reported exploitation conditions. The common operational lesson is limited: patch status and actual exposure must be assessed separately from vulnerability severity. ## Why it matters For a scientific facility, the immediate task is not to infer a working takeover from the 9.8 score. It is to identify EPICS Base versions, map Channel Access and pvAccess reachability, and move eligible systems to 7.0.11 under the facility's change-control process. Network segmentation matters because the reported attack prerequisite is access to the vulnerable service, including from an internal network. The disclosure also illustrates a useful distinction for teams evaluating autonomous security research. Cipher's output led to patches for old defects quickly, but the source separates demonstrated crash behavior from a functional remote-code-execution chain. Treat those as different evidence levels in triage and remediation planning. A vulnerability report can justify urgent inventory and mitigation without establishing that the most severe theoretical outcome has been achieved in practice. ## Limits and uncertainty The supplied report does not establish how many EPICS Base instances are reachable by attackers, whether any particular facility is vulnerable, or whether version 7.0.11 is deployed widely. It says candidate internet hosts could not be verified as EPICS and that no public exploitation was reported to CISA. It also does not demonstrate remote code execution: the described validation reached an attacker-controlled out-of-bounds heap write and process crash under AddressSanitizer. The operational effects described by Causal Security are potential consequences, not confirmed incidents. ## Skill to build now Build a short service-exposure inventory for operational software: record product version, listening ports, authentication boundary, network zone, system owner, and maintenance window. For EPICS environments, specifically review services using TCP 5064 and 5075, distinguish externally reachable services from internally reachable ones, and document an upgrade or compensating-control decision for each affected host. This converts a severity score into an auditable remediation plan. ## Reader takeaway EPICS Base 7.0.10 and earlier have four patched network-handling flaws that can reportedly be triggered without login or user action once an attacker reaches the service. Upgrade to 7.0.11 and review reachability, while keeping the evidence in proportion: no verified exposed EPICS host, public exploitation, or working RCE exploit is described. ## Open question How many operational EPICS Base deployments remain reachable from networks where an untrusted actor could access Channel Access or pvAccess? Editor: [Andrey Reshetnikov](https://newruntime.com/owner-profile.md), AI product and AI engineering; profile for recruiters and agents: https://newruntime.com/owner-profile.json ## Continue in the graph Next records for an agent, linked to their Markdown twins. Replace `.md` with `.json` for structured fields, including `next_reads`. - topic hub: [Security](https://newruntime.com/topics/security.md): Explore the security topic hub. - collection: [Field Notes](https://newruntime.com/posts.json): Open the latest editorial analysis. - collection: [Source Ledger](https://newruntime.com/source-ledger.json): Inspect the public source evidence graph. - whole graph: [discovery graph](https://newruntime.com/discovery-graph.json) (typed nodes and edges) and [site index](https://newruntime.com/site-index.md)