EPICS Base: Remote code execution and denial of service (CVE-2026-114595, CVE-2026-114596, CVE-2026-114597, CVE-2026-114598)
EPICS Base versions 7.0.10 and earlier contain multiple critical vulnerabilities in network request processing that could allow unauthenticated remote attackers to cause denial-of-service, disclose memory contents, or execute arbitrary code.
CVE search metadata
CVE search record: CVE-2026-114595. KEV: no. Product: EPICS Base (<=7.0.10). Brief: EPICS Base: Remote code execution and denial of service (CVE-2026-114595, CVE-2026-114596, CVE-2026-114597, CVE-2026-114598). Brief link: https://feed.craftedsignal.io/briefs/2026-10-epics-base-vulnerabilities/
CVE search record: CVE-2026-114596. KEV: no. Product: EPICS Base (<=7.0.10). Brief: EPICS Base: Remote code execution and denial of service (CVE-2026-114595, CVE-2026-114596, CVE-2026-114597, CVE-2026-114598). Brief link: https://feed.craftedsignal.io/briefs/2026-10-epics-base-vulnerabilities/
CVE search record: CVE-2026-114597. KEV: no. Product: EPICS Base (<=7.0.10). Brief: EPICS Base: Remote code execution and denial of service (CVE-2026-114595, CVE-2026-114596, CVE-2026-114597, CVE-2026-114598). Brief link: https://feed.craftedsignal.io/briefs/2026-10-epics-base-vulnerabilities/
CVE search record: CVE-2026-114598. KEV: no. Product: EPICS Base (<=7.0.10). Brief: EPICS Base: Remote code execution and denial of service (CVE-2026-114595, CVE-2026-114596, CVE-2026-114597, CVE-2026-114598). Brief link: https://feed.craftedsignal.io/briefs/2026-10-epics-base-vulnerabilities/
Triage facts
Revision 1- Applicability
- EPICS Base (<=7.0.10)
- Evidence
- Unknown
- Severity
- Critical
- Action
- Immediate escalation
- Sources
- 5 public sources
- Freshness
- Revision 1Oct 27, 16:40 UTC
- Vulnerabilities
- 4 CVEs
- Source quality
- A1Likely
Multiple vulnerabilities exist in EPICS Base release 7.0.10 and prior, primarily involving integer overflows and improper handling of length parameters during network message parsing. These flaws can lead to out-of-bounds memory access, corruption, and remote code execution (RCE). The EPICS Community has released version 7.0.11 to address these issues.
Impact
Successful exploitation of these vulnerabilities allows for process instability, denial-of-service, sensitive information disclosure from process memory, and potential execution of arbitrary code with the privileges of the EPICS Base process.
Recommendation
- Update all EPICS Base installations to release 7.0.11 immediately.
- Review the upstream GitHub repository pull requests (PR #934, PR #937, and pvDataCPP PR #109) for technical implementation details of the fixes.
- Restrict access to EPICS network ports to trusted management subnets to minimize the attack surface until patching is complete.
Immediate actions
Upgrade all EPICS Base deployments to version 7.0.11
Threat Hunt
Monitor network traffic for malformed or oversized requests directed at EPICS control ports
Data: Network IDS/IPS alerts, Firewall connection logs
Mitigations
Patch EPICS Base to 7.0.11
CVE-2026-114595, CVE-2026-114596, CVE-2026-114597, CVE-2026-114598