AI Agent Finds Four EPICS Control-System Flaws, Including Potential Critical RCE

Causal Security’s autonomous research system, Cipher, reportedly discovered and validated four previously unknown vulnerabilities in EPICS Base in three hours and 49 minutes. The flaws affect Channel Access and pvAccess protocol handling in version 7.0.10 and earlier. The most severe, CVE-2026-114595, is a critical integer overflow rated CVSS 9.8 that could potentially enable remote code execution; three high-severity flaws could cause crashes, memory corruption, or information disclosure. Researchers demonstrated memory corruption and a process crash, but did not achieve remote code execution.

EPICS supports equipment control and monitoring at major scientific facilities, making exploitation a potential threat to experiments and operational continuity. Attackers need network access to vulnerable control-system services, but do not require authentication. EPICS Base 7.0.11 fixes all four vulnerabilities, and CISA recommends upgrading. Operators should prioritize patching affected systems and restricting access to control-network services. CISA reported no known public exploitation, and the reports identified no confirmed compromises of scientific facilities.