Critical EPICS Vulnerabilities Expose Decades-Old Security Weaknesses in Scientific Research Infrastructure
Four previously undiscovered vulnerabilities in EPICS Base, an open-source software component used to operate major scientific research facilities, have been patched after researchers identified security weaknesses dating back as far as three decades. The flaws could allow unauthenticated attackers with network access to crash critical control processes, disclose memory contents, and potentially execute arbitrary code.
The vulnerabilities affect EPICS Base 7.0.10 and earlier and were disclosed by the U.S. Cybersecurity and Infrastructure Security Agency (CISA) on October 27, 2026. The agency recommends upgrading to version 7.0.11, which addresses all four issues.
The discovery is particularly significant because EPICS is used in specialized environments such as particle accelerators, synchrotron facilities, and nuclear fusion research installations. Interruptions to control software in these environments can affect experiments, monitoring systems, and expensive scientific equipment.
The vulnerabilities were identified by Cipher, an autonomous security research system developed by Causal Security. According to the company, the system discovered all four flaws in approximately three hours and 49 minutes, despite having no prior knowledge of the EPICS codebase or specialized instructions for attacking scientific control systems.
The findings raise two important questions for the cybersecurity industry: how critical software vulnerabilities can remain undetected for decades, and whether autonomous security research systems can help identify weaknesses in complex infrastructure that has historically received limited security scrutiny.
EPICS Provides the Software Foundation for Major Research Facilities
The Experimental Physics and Industrial Control System (EPICS) is an open-source software toolkit used to develop distributed control systems for scientific instruments and large research installations.
Unlike conventional enterprise applications, which primarily process business information, EPICS-based systems often interact with physical equipment through sensors, controllers, monitoring interfaces, and automation components.
These systems help researchers observe experimental conditions, collect measurements, and coordinate the operation of specialized equipment.
EPICS Base provides essential infrastructure for these applications, including network communication, process variables, and services that allow different components of a distributed control environment to exchange information.
The software is used in prominent scientific projects. According to Causal Security, the control architecture associated with ITER, the international nuclear fusion research project, is based on EPICS. The Advanced Photon Source at Argonne National Laboratory also makes extensive use of the toolkit.
These examples illustrate the importance of the software within the scientific community, but they do not establish that either facility was exposed to or compromised through the newly disclosed vulnerabilities.
EPICS deployments can vary considerably in configuration, network isolation, and the versions of software components they use.
Nevertheless, vulnerabilities in a foundational component such as EPICS Base can have consequences across multiple systems that depend on the same underlying functionality.
The risk is particularly relevant in operational technology environments, where availability, predictable behavior, and the safe operation of physical equipment are often as important as confidentiality.
Four Vulnerabilities Affect Network Protocol Processing
All four vulnerabilities involve the handling of network communications through Channel Access and pvAccess, two protocols used by EPICS components to exchange data.
According to Causal Security co-founder Shubham Raj, attackers do not need authentication credentials or user interaction to trigger the flaws. They must, however, be able to communicate with a vulnerable EPICS service.
The relevant services commonly use TCP port 5064 for Channel Access and TCP port 5075 for pvAccess.
That network-access requirement is central to assessing the risk. An EPICS installation isolated from untrusted networks may be substantially harder for an external attacker to reach, while a vulnerable service exposed to a compromised internal network could still present an opportunity for exploitation.
The four vulnerabilities are:
CVE-2026-114595 — CVSS 9.8 (Critical): An integer overflow in network request processing can cause the software to allocate an incorrectly sized memory buffer. Subsequent processing of attacker-controlled data may result in memory corruption, denial of service, or potentially remote code execution.
CVE-2026-114596 — CVSS 8.2 (High): An out-of-bounds write can corrupt memory, destabilize a running process, or cause a denial-of-service condition.
CVE-2026-114597 — CVSS 7.5 (High): An out-of-bounds read can expose adjacent memory contents and potentially crash the affected application.
CVE-2026-114598 — CVSS 7.5 (High): A type confusion vulnerability can be triggered by malformed network data, resulting in denial of service.
Although the vulnerabilities involve different memory-handling errors, they share an important characteristic: malicious network input can reach sensitive processing routines without requiring an authenticated user.
This makes network segmentation and service exposure especially important when evaluating affected deployments.
The severity ratings also reflect different potential consequences. CVE-2026-114595 presents the most serious theoretical impact because successful exploitation could extend beyond crashing a process to executing attacker-controlled code.
However, that outcome has not been demonstrated publicly.
Remote Code Execution Remains a Potential, Not Confirmed, Outcome
Causal Security validated the memory corruption behavior associated with the vulnerabilities, but researchers did not develop a working remote code execution exploit.
Raj explained that Cipher demonstrated an attacker-controlled out-of-bounds heap write and a process crash using AddressSanitizer, a tool designed to detect memory safety violations.
Once the memory corruption condition had been confirmed, the researchers did not pursue the additional work required to turn it into a functional code execution exploit.
This distinction matters because memory corruption does not automatically guarantee reliable remote code execution.
A successful exploit may require additional control over memory layout, suitable execution conditions, and techniques capable of overcoming operating system protections.
The observed evidence supports the possibility of denial-of-service attacks and memory corruption under vulnerable conditions. Remote code execution remains a plausible consequence of the most severe flaw, but it should not be presented as a demonstrated capability.
CISA has not received reports of public exploitation involving the four vulnerabilities.
The number of internet-accessible EPICS deployments is also unknown. Causal Security conducted a limited search using Censys and identified potential candidates based on exposed network ports, but none could be conclusively verified as running EPICS.
As a result, there is no reliable public estimate of how many research facilities are directly exposed to exploitation over the internet.
The absence of confirmed exploitation should not be interpreted as evidence that the vulnerabilities are harmless. Instead, it establishes the current limits of publicly available threat intelligence.
For operators, the appropriate response is to assess affected software versions and network accessibility without assuming that a widespread attack campaign is already underway.
Exploitation Could Disrupt Expensive Scientific Experiments
The potential operational impact of the vulnerabilities extends beyond the consequences typically associated with a crashed enterprise application.
Scientific facilities frequently coordinate complex equipment through distributed control systems. Experimental processes may depend on continuous monitoring, reliable communications, and carefully controlled operating conditions.
An interruption to a critical EPICS process could interfere with data collection or require operators to stop and restart portions of an experiment.
Raj warned that successful attacks could potentially interrupt particle beams, disrupt experiments, cause the loss of monitoring information, or contribute to expensive equipment shutdowns.
These are possible operational consequences rather than documented incidents involving the newly disclosed flaws.
The actual impact would depend on which EPICS process was affected, its role in the facility, and the independent safety mechanisms protecting the equipment.
Large research installations typically employ multiple layers of operational safeguards, and a software process failure does not necessarily translate into physical damage or unsafe conditions.
Nevertheless, availability is a particularly important security objective in scientific and industrial control environments.
An attacker may not need to steal information or maintain long-term access to cause significant disruption. Triggering repeated process crashes at critical moments could be enough to interrupt experiments or impose substantial recovery costs.
This illustrates why denial-of-service vulnerabilities in operational technology deserve careful attention, even when remote code execution has not been achieved.
Autonomous AI Discovered Vulnerabilities Hidden for Up to 31 Years
One of the most notable aspects of the research is the speed with which Cipher identified weaknesses that had remained in the EPICS codebase for decades.
According to Causal Security, the autonomous system began its investigation without prior knowledge of EPICS and without instructions describing specific exploitation techniques for scientific control systems.
The initial analysis proceeded without human direction. After identifying the vulnerabilities, Cipher received a single follow-up instruction to examine their exploitability more closely.
The complete discovery process took approximately three hours and 49 minutes.
A subsequent review of the code history indicated that the vulnerabilities had existed for between approximately 14.5 and 31.5 years.
Their longevity highlights a recurring problem in mature software projects. Code that has operated reliably for many years may still contain security weaknesses, particularly in low-level routines responsible for parsing network messages and managing memory.
Long-term operational stability can also create a false sense of security. Software may function correctly under expected conditions while remaining vulnerable to deliberately malformed inputs that ordinary users and automated functional tests rarely generate.
The EPICS findings demonstrate how security testing differs from conventional software quality assurance. A system can satisfy its intended functional requirements and still contain exploitable memory safety defects.
Autonomous vulnerability research offers a potential way to expand the scope of security assessments, especially for open-source projects that maintain extensive codebases but lack dedicated security teams.
However, the results should not be interpreted as proof that autonomous systems can independently discover and exploit every vulnerability.
Cipher identified the weaknesses and demonstrated memory corruption, but it did not produce a working remote code execution exploit. Human researchers also remained involved in validating, reporting, and coordinating the findings.
The significance of the achievement lies in accelerating the discovery of previously overlooked security problems, not eliminating the need for expert analysis.
Coordinated Disclosure Leads to EPICS Base 7.0.11
Causal Security notified EPICS maintainers about the vulnerabilities on June 9, 2026.
The maintainers subsequently merged fixes during July and August, allowing the security issues to be addressed before their broader public disclosure in October.
CISA published its advisory on October 27, recommending that organizations running EPICS Base 7.0.10 or earlier upgrade to version 7.0.11.
The coordinated disclosure process provided maintainers with time to investigate the reported issues and prepare corrections before detailed information became widely available.
This approach is particularly important for operational technology environments, where software updates may require more extensive testing than conventional enterprise applications.
Research facilities often operate specialized equipment with tightly controlled configurations. Updating a central software component can introduce compatibility concerns involving instrumentation, control applications, and other dependencies.
As a result, administrators may need to validate changes in a representative environment before deploying them to production systems.
Nevertheless, the existence of operational constraints does not eliminate the need for remediation. It makes planning, testing, and appropriate compensating controls essential.
The EPICS findings also follow other vulnerability disclosures involving autonomous research conducted by Causal Security.
Earlier in October, the company reported weaknesses in Grid Protection Alliance's openPDC and openHistorian software, which are used to process electrical grid measurement data. Its research also identified vulnerabilities in the FreeRTOS-Plus-TCP networking stack.
Together, these discoveries suggest that autonomous code analysis may be particularly useful for examining mature infrastructure software containing complex network protocol implementations.
How Research Facilities Should Reduce Their Exposure
Organizations using EPICS should begin by identifying installations running affected versions of EPICS Base and determining whether vulnerable services are accessible from untrusted networks.
Because all four vulnerabilities can reportedly be triggered without authentication, restricting access to the affected network services is an important defensive measure.
Recommended actions include:
Upgrade to EPICS Base 7.0.11. Apply the corrected release after completing the compatibility testing required by the facility's operational procedures.
Review network exposure. Identify systems using Channel Access and pvAccess, particularly services accessible through TCP ports 5064 and 5075.
Enforce network segmentation. Restrict communications with EPICS control services to authorized hosts and trusted operational networks.
Monitor unexpected process failures. Investigate unexplained crashes or unusual network traffic directed at EPICS services, while recognizing that these events alone do not establish exploitation.
Maintain an accurate software inventory. Document EPICS versions, dependent applications, system owners, and maintenance requirements.
Validate recovery procedures. Ensure critical control services can be restored safely if a process fails or an update introduces unexpected behavior.
Facilities should also assess the consequences of losing individual control processes. Understanding which systems support critical monitoring or experimental operations can help determine remediation priorities.
The immediate objective is to reduce access to vulnerable services while completing the transition to a patched release.
Decades-Old Vulnerabilities Reveal a Wider Infrastructure Security Challenge
The EPICS disclosure illustrates how long-standing software components can retain serious security weaknesses even after decades of widespread operational use.
The four vulnerabilities were not discovered through an observed intrusion or a confirmed attack against a research facility. They emerged from an autonomous security assessment that identified memory-handling defects in network protocol implementations.
Their potential consequences are significant because EPICS supports scientific environments where availability and operational continuity are essential.
At the same time, the available evidence requires careful interpretation. Researchers demonstrated memory corruption and process crashes, but not functional remote code execution. CISA has reported no known public exploitation, and the number of internet-exposed EPICS installations remains unverified.
Those limitations do not diminish the importance of the patches. They provide the context necessary for an accurate assessment of the risk.
The discovery also highlights the potential of autonomous security research to uncover defects in software that may have received relatively little adversarial testing despite its importance to critical scientific operations.
The central lesson is that software maturity does not guarantee security, and vulnerabilities hidden for decades can still threaten the availability of essential research infrastructure.
For EPICS operators, the priority is clear: identify affected deployments, restrict network access to vulnerable services, and upgrade to version 7.0.11 through established operational change-control procedures.
For the wider cybersecurity industry, the findings offer a compelling example of how autonomous vulnerability discovery could complement traditional security research and help expose weaknesses in the foundational software supporting modern scientific infrastructure.