Critical EPICS Base Flaws Expose Industrial Control Systems to Remote Code Execution

As reported by CISA in advisory ICSA-26-300-01, four vulnerabilities in EPICS Base release 7.0.10 and prior collectively threaten critical manufacturing environments with remote code execution, denial of service, and information disclosure. The most severe — CVE-2026-114595 — carries a CVSS v3.1 score of 9.8 (Critical), reflecting a network-exploitable flaw requiring no authentication or user interaction.

Vulnerability Summary

Affected Product: EPICS Base release <=7.0.10 (all prior versions)
Vendor: The EPICS Community (open-source, globally deployed)
Patch Available: Yes — update to EPICS Base 7.0.11
Active Exploitation: Not confirmed in the wild at time of advisory, but exploit feasibility is high given network reachability

Why This Matters

EPICS (Experimental Physics and Industrial Control System) is an open-source middleware framework used worldwide in particle accelerators, telescopes, and — critically — in industrial control applications within critical manufacturing. Its widespread adoption in research institutions and industrial facilities means these vulnerabilities span organizational boundaries in ways that proprietary ICS vulnerabilities typically do not.

The attack surface is particularly concerning: CVE-2026-114595 is reachable over the network with no authentication required. An attacker who can reach the CA (Channel Access) or PVAccess protocol port can send a crafted message that triggers an integer overflow during allocation, leading to a heap buffer overflow. In a control system context, this is not merely a data breach — it is a potential safety event. Process controllers managing physical equipment could be destabilized, and arbitrary code execution on a control network host provides a direct path to manipulate field devices.

Open-source ICS frameworks like EPICS often lack the rapid patch distribution pipelines that commercial vendors provide. Facilities must actively monitor upstream repositories and apply fixes manually — a gap that threat actors exploit.

Who Is at Risk

Shield53 Recommendations

Immediate Actions

• Patch now: Upgrade to EPICS Base 7.0.11 from the official GitHub repository. Do not delay for maintenance windows — the RCE risk justifies emergency change procedures.
• Segment control networks: Ensure EPICS protocol ports (CA: 5064/UDP/TCP, PVAccess: 5075/UDP/TCP) are not reachable from corporate IT or internet-facing segments. Verify firewall rules and VLAN boundaries.
• Deploy network monitoring: Add detection rules for anomalous CA/PVAccess traffic — unusually large payload length fields or unexpected message types may indicate exploitation attempts.
• Inventory and assess: Identify all hosts running EPICS Base, including embedded IOCs (Input Output Controllers). Many facilities lose track of soft IOCs deployed on researcher workstations.
• Apply defense-in-depth: If patching is delayed, implement allowlisting at network gateways for CA/PVAccess traffic and restrict to known IOC IP addresses.

Longer-Term Measures

• Establish a subscription to EPICS Controls security announcements and CISA ICS advisories
• Conduct regular fuzzing of protocol handlers in test environments to catch similar integer handling flaws before upstream disclosure
• Review whether EPICS Gateways or protocol bridges can isolate critical process IOCs from less-trusted network zones

These vulnerabilities underscore a recurring pattern in ICS software: insufficient input validation on protocol parsers that were designed for trusted networks. The assumption of network-level trust no longer holds. Facilities must treat every protocol endpoint as a potential attack surface and prioritize upstream monitoring for open-source components they depend on for physical process control.