# EPICS Base 7.0.11 fixes four memory-safety bugs, including a critical 9.8 integer overflow that can lead to remote code execution · pwn.watch > On October 27 CISA published ICS advisory ICSA-26-300-01 for EPICS Base, the open source control-system toolkit used to run particle accelerators, fusion experiments and other large research facilities. EPICS Base 7.0.10 and earlier have four bugs in network message handling: CVE-2026-114595 (CVSS 3.1 9.8, critical), an integer overflow in network request processing that allocates memory with the wrong size and can lead to memory corruption, denial of service or potential remote code execution; CVE-2026-114596 (8.2), an integer overflow from improper message length validation that causes an out-of-bounds write; CVE-2026-114597 (7.5), out-of-bounds reads from insufficient bounds checking; and CVE-2026-114598 (7.5), a type confusion that can cause denial of service and expose adjacent memory. Shubham Raj of Causal Security reported them, and The Register reports the company's autonomous AI agent Cipher found all four in under four hours. The EPICS community released EPICS Base 7.0.11 with the fixes; CISA's advisory does not mention exploitation. Update to 7.0.11 and keep EPICS networks isolated from untrusted access. Page: https://pwn.watch/i/epics-base-7-0-11-critical-memory-bugs-oct-2026 · generated 2026-10-27T21:22:56.776Z ## Status - Severity: critical · status: live · patch: patched - Product: EPICS Base (Experimental Physics and Industrial Control System) - Started: 2026-10-27 - CVEs: CVE-2026-114595, CVE-2026-114596, CVE-2026-114597, CVE-2026-114598 - Affected: EPICS Base 7.0.10 and earlier - Fixed in: EPICS Base 7.0.11 ## Follow this incident - RSS (one item per update): https://pwn.watch/i/epics-base-7-0-11-critical-memory-bugs-oct-2026/feed.xml - JSON Feed: https://pwn.watch/i/epics-base-7-0-11-critical-memory-bugs-oct-2026/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/epics-base-7-0-11-critical-memory-bugs-oct-2026.json - This file: https://pwn.watch/i/epics-base-7-0-11-critical-memory-bugs-oct-2026/llms.txt ## Updates (newest first) - 2026-10-27: The EPICS community releases EPICS Base 7.0.11 with the fixes. (https://github.com/epics-base/epics-base/releases/tag/R7.0.11) - 2026-10-27: CISA publishes ICSA-26-300-01 for EPICS Base, rating CVE-2026-114595 9.8 and the other three bugs 7.5 to 8.2, and tells users to update to 7.0.11. (https://www.cisa.gov/news-events/ics-advisories/icsa-26-300-01) ## Fix brief # Security brief: EPICS Base 7.0.11 fixes four memory-safety bugs, including a critical 9.8 integer overflow that can lead to remote code execution Source: https://pwn.watch/i/epics-base-7-0-11-critical-memory-bugs-oct-2026 · status: live · severity: critical · updated Oct 27, 2026, 19:26 UTC ## Patch status **PATCHED: fixed releases exist. Upgrade to a fixed version.** ## What it is On October 27 CISA published ICS advisory ICSA-26-300-01 for EPICS Base, the open source control-system toolkit used to run particle accelerators, fusion experiments and other large research facilities. EPICS Base 7.0.10 and earlier have four bugs in network message handling: CVE-2026-114595 (CVSS 3.1 9.8, critical), an integer overflow in network request processing that allocates memory with the wrong size and can lead to memory corruption, denial of service or potential remote code execution; CVE-2026-114596 (8.2), an integer overflow from improper message length validation that causes an out-of-bounds write; CVE-2026-114597 (7.5), out-of-bounds reads from insufficient bounds checking; and CVE-2026-114598 (7.5), a type confusion that can cause denial of service and expose adjacent memory. Shubham Raj of Causal Security reported them, and The Register reports the company's autonomous AI agent Cipher found all four in under four hours. The EPICS community released EPICS Base 7.0.11 with the fixes; CISA's advisory does not mention exploitation. Update to 7.0.11 and keep EPICS networks isolated from untrusted access. Severity detail: CVSS 3.1 9.8 (CVSS 4.0 9.3) for CVE-2026-114595, network-reachable without authentication; CISA's advisory does not mention exploitation - Product: EPICS Base (Experimental Physics and Industrial Control System) - CVE / advisory ids: CVE-2026-114595, CVE-2026-114596, CVE-2026-114597, CVE-2026-114598 ## Affected versions - EPICS Base 7.0.10 and earlier ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix Upgrade to one of these fixed versions (or later on the same branch): - EPICS Base 7.0.11 After upgrading, re-run the checks above and redeploy/restart the affected services. ## Latest updates - Oct 27, 2026: The EPICS community releases EPICS Base 7.0.11 with the fixes. - Oct 27, 2026: CISA publishes ICSA-26-300-01 for EPICS Base, rating CVE-2026-114595 9.8 and the other three bugs 7.5 to 8.2, and tells users to update to 7.0.11. ## Advisories - [ICSA-26-300-01: EPICS Base](https://www.cisa.gov/news-events/ics-advisories/icsa-26-300-01) (CISA) - [EPICS Base R7.0.11 release](https://github.com/epics-base/epics-base/releases/tag/R7.0.11) (EPICS) ## Write-ups & news - [AI 'hacker' finds 4 severe bugs in popular industrial control software in under 4 hours](https://www.theregister.com/security/2026/10/27/ai-hacker-finds-4-severe-bugs-in-popular-industrial-control-software-in-under-4-hours/5305811) --- Machine-readable: https://pwn.watch/i/epics-base-7-0-11-critical-memory-bugs-oct-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.