> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # AI agent finds 4 critical EPICS Base flaws including RCE CVE-2026-114595 - URL: https://f4n6.co.uk/security-feed/ai-agent-finds-4-critical-epics-base-flaws-including-rce-cve-2026-114595/ - Published: 2026-10-27T21:17:29.000Z - Updated: 2026-10-27T21:17:29.000Z - Author: Jeff Davies - Tags: #security-feed, CVE-2026-114595, CVE-2026-114596, CVE-2026-114597, CVE-2026-114598 ## 1\. Executive summary An autonomous AI agent operated by Causal Security found four previously unknown memory-safety vulnerabilities in EPICS Base, the open source control-system toolkit used to build SCADA systems for particle accelerators, fusion reactors and about 90 scientific and industrial facilities worldwide. The most severe, CVE-2026-114595, is rated 9.3 CRITICAL (integer overflow, CWE-190) and allows attacker-controlled network data to cause an out-of-bounds heap write with potential remote code execution; the other three are CVE-2026-114596 at 8.8 HIGH, CVE-2026-114597 at 8.7 HIGH and CVE-2026-114598 at 8.7 HIGH. None of the four is in CISA KEV, so there is no confirmed in-the-wild exploitation, and the fix is EPICS Base 7.0.11\. For EMEA financial services the direct exposure is narrow: EPICS is not core banking infrastructure, but it is present in research, laboratory, and some industrial control environments that banks fund, host or connect to, and the flaws matter most where an EPICS control network is reachable from a corporate or shared network. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 28 | EPICS Base is third-party open source software embedded in control systems a financial entity may operate or depend on, and the fix is a vendor version upgrade to 7.0.11 | Third-party risk management must cover the open source component and its patch cadence, not only contracted vendors | | NIS2 Art. 21(2)(d) | The vulnerability sits in a software supply chain component (EPICS Base) shared across many facilities, and exploitation depends on network reachability to that component | Supply chain security measures must include inventorying EPICS Base versions and controlling network paths to EPICS services | No DORA incident-reporting article is engaged on current evidence: there is no confirmed exploitation and no incident at a client. ## 3\. Technical analysis & attack chain All four flaws affect EPICS Base. The vendor fix is version 7.0.11\. CISA published an advisory on Tuesday 2026-10-27 stating that successful exploitation could cause denial of service, memory corruption, sensitive information disclosure, or potentially arbitrary code execution. Confirmed attack chain, as far as the sources support it: 1. The attacker gains network reachability to a vulnerable EPICS service on a facility control network. The source states this is the prerequisite, and that it can occur where networks are not sufficiently segmented or another system has access to the EPICS network. 2. The attacker sends crafted network data to the EPICS service. For CVE-2026-114595 this data drives an integer overflow that produces an attacker-controlled out-of-bounds heap write. 3. Depending on the flaw, the outcome is a controller-process crash (denial of service), memory corruption, disclosure of adjacent memory contents, or, for CVE-2026-114595, potential remote code execution. 4. Where RCE is achieved, the attacker can take control of the affected process, manipulate readings, interfere with control functions, or disrupt connected equipment. The four vulnerabilities: - CVE-2026-114595, 9.3 CRITICAL, CWE-190 integer overflow. Attacker-controlled network data causes an out-of-bounds heap write with potential for remote code execution. This is the only one of the four with an RCE path described. - CVE-2026-114596, 8.8 HIGH, CWE-190 integer overflow. Improper message-length validation leads to an out-of-bounds memory write and controller-process crash. - CVE-2026-114597, 8.7 HIGH, CWE-130\. Insufficient bounds checking allows out-of-bounds memory reads and process crashes. - CVE-2026-114598, 8.7 HIGH, CWE-843\. Type confusion leading to denial of service, with possible exposure of adjacent memory contents. Severity discrepancy: the source quotes CVSS v3.1 scores of 9.8, 8.2, 7.5 and 7.5 for these four CVEs. The NVD values above (9.3, 8.8, 8.7, 8.7) are authoritative and are what this advisory uses. The CWE classifications agree between the source and NVD. Discovery context: the agent, named Cipher, found and validated all four in three hours and 49 minutes with no human intervention during initial investigation, followed by one instruction authorising deeper exploitability testing in a secure environment, according to Causal Security co-founder Shubham Raj. The same tool is reported to have found critical attack paths in North American and European power-grid systems earlier in 2026, prompting a CISA advisory on 2026-10-08\. These discovery claims are single-sourced to Causal Security via The Register and are not independently corroborated in the material available here. Exploitation difficulty: Raj states that reaching a misconfigured or reachable EPICS network makes the attacks "pretty easy" and that they do not require deep OT knowledge or understanding of accelerator physics. Manipulating a specific physical process would need additional knowledge, but crashing processes or interrupting monitoring does not. Treat this as the vendor-adjacent discoverer's assessment, not an independently tested claim. No malware, payload, persistence mechanism, command-and-control channel, lateral movement technique or named threat actor appears in the sources. No attribution to any actor is made, and none should be inferred. ## 4\. Mitigation & containment P1 (within 24 hours) - Inventory EPICS Base deployments and record the version of every instance. Any instance below 7.0.11 is exposed to all four CVEs. - Where EPICS Base 7.0.11 cannot be deployed immediately, restrict network access to EPICS services to the minimum set of control-network hosts that require it. The source identifies network reachability as the sole exploitation prerequisite. - Check segmentation between EPICS control networks and corporate, research-partner and shared networks. The source states exploitation becomes feasible where segmentation is insufficient or another system has access to the EPICS network. P2 (within 72 hours) - Upgrade EPICS Base to 7.0.11\. This is the vendor fix and covers all four CVEs. - For any instance that cannot be upgraded, apply host or network ACLs that limit inbound connections to the EPICS service ports to known operator and engineering workstations. - Add monitoring for controller-process crashes on EPICS hosts. CVE-2026-114596, CVE-2026-114597 and CVE-2026-114598 all produce process crashes, which give a detectable signal of attempted exploitation even without RCE. P3 (within 7 days) - Add EPICS Base to the open source component inventory used for third-party and supply chain risk review, with the version recorded and a patch cadence assigned. - Where a bank funds, hosts or connects to a research or industrial facility running EPICS, confirm with the operator that 7.0.11 has been applied or that network isolation is in place. ## 5\. Indicators of compromise No indicators of compromise available in the source material. The sources describe no hashes, domains, IP addresses, file paths, registry keys or command-line artefacts. The only observable behaviour described is controller-process crash following crafted network data to an EPICS service. Behavioural indicators | behaviour | where to observe | confidence | | -------------------------------------------------------------------------------------------------------- | ------------------------------------------------- | -------------------------------------------------------------------------------------------------- | | Controller-process crash following inbound network data to an EPICS service | EPICS host process logs and OS crash records | Medium, inferred from the described impact of CVE-2026-114596, CVE-2026-114597 and CVE-2026-114598 | | Unexpected outbound or inbound connections to EPICS service ports from hosts outside the control network | Network flow logs at the control-network boundary | Low, based on the stated reachability prerequisite, not on observed traffic | ## 6\. Detection Insufficient indicators to author detection rules. The sources give no distinctive strings, command-line flags, file names, registry keys or network artefacts specific to exploitation. A rule built on the CVE identifiers or the product name would detect reporting about the flaws, not exploitation of them. ## CVE assessment 4 referenced CVEs — 1 critical (CVSS ≥ 9.0) | CVE | CVSS | Exploited | EPSS | Summary | | ---------------------------------------------------------------------------------- | ------------ | --------- | ---- | -------------------------------------------------------------------------------------------------------------------------------- | | [CVE-2026-114595](https://nvd.nist.gov/vuln/detail/CVE-2026-114595?ref=f4n6.co.uk) | 9.3 Critical | — | — | In EPICS Base release 7.0.10 and prior, an integer overflow in network request processing can cause memory to be allocated with… | | [CVE-2026-114596](https://nvd.nist.gov/vuln/detail/CVE-2026-114596?ref=f4n6.co.uk) | 8.8 High | — | — | In EPICS Base release 7.0.10 and prior, an improper validation of message length values during protocol parsing can trigger an… | | [CVE-2026-114597](https://nvd.nist.gov/vuln/detail/CVE-2026-114597?ref=f4n6.co.uk) | 8.7 High | — | — | In EPICS Base release 7.0.10 and prior, an insufficient validation of element or length values in a network message can cause t… | | [CVE-2026-114598](https://nvd.nist.gov/vuln/detail/CVE-2026-114598?ref=f4n6.co.uk) | 8.7 High | — | — | In EPICS Base release 7.0.10 and prior, an insufficient validation of element or length values in a network message can cause t… | ## 7\. Sources - The Register, "AI 'hacker' finds 4 severe bugs in popular industrial control software in under 4 hours", 2026-10-27\. https://www.theregister.com/security/2026/10/27/ai-hacker-finds-4-severe-bugs-in-popular-industrial-control-software-in-under-4-hours/5305811 - CISA advisory referenced in the above, published Tuesday 2026-10-27\. No URL supplied in the source material. - CISA advisory of 2026-10-08 on power-grid attack paths, referenced in the above. No URL supplied in the source material. ## 8\. Adverse Trace position Adverse Trace assesses CVE-2026-114595 as the priority item at 9.3 CRITICAL with a heap-write-to-RCE path, and the remaining three as 8.8, 8.7 and 8.7 HIGH respectively. None is in CISA KEV and no exploitation is confirmed, so this is a patch-and-isolate advisory rather than an incident response one. Client impact for EMEA financial services is limited to entities that operate EPICS, fund or host facilities that do, or share network paths with such facilities; for those, the exposure is real because the only barrier is network reachability. The discovery and capability claims about the Cipher agent are single-sourced to Causal Security and should be treated as unconfirmed until independently reported. We will track CISA's advisory for a published URL and any revision to the CVSS scores, watch for KEV addition or public exploit code for CVE-2026-114595, and reissue this note if either occurs. --- [Read the original source →](https://www.theregister.com/security/2026/10/27/ai-hacker-finds-4-severe-bugs-in-popular-industrial-control-software-in-under-4-hours/5305811?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*