Plan ahead Critical Patch available CVSS up to 9.8
EPICS Base has four flaws, including possible remote code execution
CISA ICS AdvisoriesEPICS Community, EPICS Base · critical manufacturingCVE-2026-114595, CVE-2026-114596, CVE-2026-114597
What happened. EPICS Base release 7.0.10 and earlier has four flaws (CVE-2026-114595 to CVE-2026-114598). They could cause denial of service, memory corruption, data disclosure or code execution. One is an integer overflow in network request processing. Rated CVSS 9.8.
Who is affected. Users of EPICS Base release 7.0.10 and earlier, the research facility control software from The EPICS Community. The advisory lists the critical manufacturing sector.
What to do. Check whether you run EPICS Base 7.0.10 or earlier, then apply the vendor's mitigation or fix from the advisory.
When to act. Plan ahead: CVSS 9.8
Editor's reading
Forasset ownerOT security lead
- Purdue level
- L2
- L1
Why: EPICS Base is control-system software that runs on controllers and on servers that handle network requests (L1 and L2). The report does not give exact placement.
- Are you exposed?
Search the asset inventory for EPICS Base installations and check whether the release is 7.0.10 or earlier.
- If you cannot fix it yet
- Restrict network access to EPICS services to known control-system hosts.
- Block EPICS network traffic from the IT network and the internet at the OT firewall.
- Watch for
- EPICS network requests from unknown hosts, or malformed or oversized requests.
- Unexpected crashes or restarts of EPICS processes, which could indicate memory corruption or exploitation attempts.
- ATT&CK for ICS
- T0866Exploitation of Remote Services
Inferred from the facts above, not stated by the source. Check it against your own site before acting.
Source: CISA ICS Advisories (opens cisa.gov)
More on Manufacturing CVE-2026-114595 CVE-2026-114596 CVE-2026-114597