High Patch available CVSS up to 7.1
Flaws in PEAK-System CAN drivers for Windows could crash the system
CISA ICS AdvisoriesHMS Networks, PEAK-System · transport, healthcare, energyCVE-2026-109576, CVE-2026-101103, CVE-2026-94188
What happened. Several memory-handling flaws were found in HMS Networks PEAK-System PCAN Windows drivers. Successful exploitation could crash the Windows kernel. The vendor rates the flaws 7.1 on the CVSS v3 scale.
Who is affected. PEAK-System Device Driver Setup up to 5.1.2.1151 and PCAN Windows CAN device drivers up to 5.1.2. Sectors named: transport, healthcare, energy and critical manufacturing.
What to do. Check whether you run PCAN Windows CAN device drivers 5.1.2 or earlier, then apply the vendor's update following the CISA advisory.
Editor's reading
Forasset ownerOT security lead
- Purdue level
- L2
Why: The PCAN drivers run on Windows hosts that connect to CAN bus devices, which typically means engineering or operator workstations at L2.
- Are you exposed?
Search the software inventory of Windows hosts for PEAK-System Device Driver Setup up to 5.1.2.1151 or PCAN drivers up to 5.1.2.
- If you cannot fix it yet
- Restrict who can plug in or configure CAN adapters on Windows hosts that use these drivers.
- Limit logons to hosts running the drivers to named engineering staff.
- Watch for
- Unexpected Windows kernel crashes or blue-screen restarts on hosts with PCAN drivers installed.
- Unplanned installs or changes to the PEAK-System driver on engineering or test machines.
Inferred from the facts above, not stated by the source. Check it against your own site before acting.
Source: CISA ICS Advisories (opens cisa.gov)
More on Transport Healthcare Energy and power CVE-2026-101103 CVE-2026-109576 CVE-2026-94188