Source: cisa.gov
CISA published ICS advisory ICSA-26-300-01 covering four vulnerabilities in EPICS Base versions 7.0.10 and prior, used in critical manufacturing infrastructure worldwide. The highest severity CVE-2026-114595 scores 9.8 (CRITICAL) on CVSS v3.1 and involves an integer overflow in network request processing that can lead to memory corruption, denial of service, or remote code execution. CVE-2026-114596 (CVSS 8.2 HIGH) involves improper validation of message length values causing integer overflow and out-of-bounds memory write. CVE-2026-114597 (CVSS 7.5 HIGH) and CVE-2026-114598 (CVSS 7.5 HIGH) involve insufficient validation of element/length values enabling out-of-bounds reads, potential DoS, and memory disclosure. All vulnerabilities are remotely exploitable with no authentication or user interaction required. The EPICS Community has released version 7.0.11 as the fix. These vulnerabilities were reported by Shubham Raj of Cipher/Causal Security. No known public exploitation has been reported at this time.
