Long-Hidden Flaws Patched in EPICS Research Facility Control Software

What it is

Four vulnerabilities in EPICS Base 7.0.10 and earlier, disclosed in a CISA advisory and found by Cipher, an autonomous security research system from Causal Security. EPICS Base is the core of the open source toolkit used to build control systems at large research facilities. Causal says ITER's fusion reactor control system is based on EPICS and the Advanced Photon Source at Argonne National Laboratory uses it heavily.

How it works

All four bugs are in the handling of Channel Access and pvAccess, the EPICS network protocols.

Preconditions / Affected

EPICS Base 7.0.10 and earlier. Causal co-founder Shubham Raj says all four can be triggered without authentication or user interaction. The attacker needs network access to the EPICS services, typically TCP 5064 (Channel Access) or TCP 5075 (pvAccess). That access could come from an exposed service or from inside a facility network.

What to do

CISA recommends updating to EPICS Base 7.0.11. The page names no workaround. Because the precondition is reachability of the two ports, check which hosts expose TCP 5064 and 5075 and to whom.

Caveats

• Remote code execution has not been shown. Cipher demonstrated an attacker-controlled out-of-bounds heap write and a process crash under AddressSanitizer, and Raj did not pursue a working RCE exploit. The RCE risk for CVE-2026-114595 is possible, not proven.
• The operational harms Raj lists (interrupted beams, disrupted experiments, lost monitoring data, costly shutdowns) are Raj's assessment. The shutdown scenario depends on RCE.
• The number of internet-facing EPICS deployments is unknown. A brief Censys check found candidates by port, but none could be verified as EPICS.
• No public exploitation has been reported to CISA.
• Cipher's code history review puts the flaws at roughly 14.5 to 31.5 years old. Causal says Cipher took about 3 hours 49 minutes to find the four bugs, starting with no EPICS knowledge.
• EPICS maintainers were notified on June 9 and merged patches in July and August. The page does not give the year or say which fix landed when.