Four EPICS Base Flaws Expose Critical Manufacturing to RCE and DoS

Key points

• Four CVEs affect EPICS Base: CVE-2026-114595 through CVE-2026-114598.
• Impacts include service disruption, memory corruption, leakage of sensitive data, and execution of arbitrary code.
• Exploitation is tied to how the software handles network requests.
• EPICS Base is deployed worldwide, including in critical manufacturing environments.

An attacker can exploit four newly identified vulnerabilities in EPICS Base, a software component maintained by the EPICS Community. The flaws are tracked as CVE-2026-114595, CVE-2026-114596, CVE-2026-114597, and CVE-2026-114598. According to the available facts, the weaknesses are reachable during network request processing, meaning a remote actor could attempt to abuse them over a network path.

Successful exploitation could produce several outcomes: denial of service, memory corruption, disclosure of sensitive information, and arbitrary code execution. Those impacts range from disrupting operations to allowing an intruder to run code on a vulnerable system. Because EPICS Base is deployed worldwide and supports critical manufacturing environments, the consequences are not limited to a single site or region.

The affected population includes organizations that rely on EPICS Base in industrial and scientific control settings. Critical manufacturing is specifically called out, which raises the stakes for availability and safety. Even a denial-of-service condition can interrupt production, while memory corruption and code execution create opportunities for deeper compromise.

Context matters here: EPICS is widely used in control-system ecosystems, so a flaw in its base layer can propagate across many installations. The facts do not specify affected versions, exploit prerequisites, or whether public exploitation has occurred. Analysts should treat the combination of network reachability and severe impact as a reason to prioritize review.

What to watch: vendor advisories from the EPICS Community, updates to the four CVE records, and any signs of exploitation in network request handling. Defenders should inventory EPICS Base deployments, limit unnecessary network exposure, and monitor for anomalous requests or service disruptions.

What to do now

1. Inventory all EPICS Base installations and identify which systems process network requests from untrusted networks.
2. Apply vendor-provided updates or mitigations for CVE-2026-114595 through CVE-2026-114598 as soon as they are available.
3. Restrict network access to EPICS Base services using allowlists, segmentation, and firewall rules; avoid exposing them directly to the internet.
4. Monitor logs and network traffic for unusual request patterns, crashes, memory errors, or service outages that could indicate exploitation.
5. Back up configurations and critical data, and test recovery procedures for denial-of-service scenarios.
6. Review accounts and permissions on EPICS hosts to reduce the impact of information disclosure or code execution.
7. Coordinate with the EPICS Community and sector peers for updated indicators and guidance.

CVE references

• CVE-2026-114595
• CVE-2026-114596
• CVE-2026-114597
• CVE-2026-114598

Original source

CISA Advisories