Long-Hidden Flaws Patched in EPICS Research Facility Control Software

CISA has published an advisory detailing four vulnerabilities in EPICS Base, the open-source toolkit underpinning control systems at particle accelerators, fusion reactors (including ITER) and large-scale research facilities such as Argonne's Advanced Photon Source. The flaws affect EPICS Base 7.0.10 and earlier, and the agency urges upgrading to version 7.0.11. All four issues stem from how the software handles the Channel Access and pvAccess network protocols, and none require authentication or user interaction — only network access to the exposed services (commonly TCP ports 5064 or 5075). The most serious, CVE-2026-114595, carries a CVSS score of 9.8 and is an integer overflow that can cause memory corruption, denial-of-service, or potentially remote code execution; the other three (CVE-2026-114596, CVE-2026-114597, CVE-2026-114598) can trigger crashes, data leakage or application instability. The bugs were uncovered by Causal Security's AI-driven research tool Cipher in under four hours, and researchers note the underlying code defects had existed undetected for roughly 14 to 31 years. No real-world exploitation has been reported, and full remote-code-execution was not actually demonstrated, though a controlled proof-of-concept confirmed attacker-controlled memory corruption.