Autonomous AI agent Cipher finds four EPICS Base flaws, including a CVSS 9.8 RCE, in under four hours
An autonomous AI agent called Cipher, developed by Causal Security, discovered four previously unknown vulnerabilities in EPICS Base (Experimental Physics and Industrial Control System), an open source SCADA toolkit used in about 90 major scientific, university and industrial facilities, including Argonne's Advanced Photon Source and ITER's fusion reactor control system. CISA published an advisory on the flaws, which affect EPICS Base 7.0.10 and earlier (securityweek.com); the most severe could allow remote code execution. Per Causal Security co-founder Shubham Raj, Cipher found and validated all four in 3 hours 49 minutes, with one human instruction authorizing deeper exploitability testing in a secure environment. No in-the-wild exploitation is reported; securityweek.com states none has been reported to CISA. Exploitation requires network reachability to vulnerable EPICS services, which poorly segmented control networks could allow. RCE has not actually been achieved: Cipher only demonstrated an out-of-bounds heap write and crash, and no functional RCE exploit was pursued (securityweek.com).
Entenda a falha
A vulnerabilidade
Four flaws in EPICS Base, the open source SCADA toolkit, affect 7.0.10 and earlier and are fixed in 7.0.11. The worst is CVE-2026-114595 (CVSS 9.8), an integer overflow that causes a wrongly sized allocation, an attacker-controlled out-of-bounds heap write and potentially remote code execution. CVE-2026-114596 (8.2) is improper message-length validation causing an out-of-bounds write and a controller process crash. CVE-2026-114597 (7.5) is insufficient bounds checking allowing out-of-bounds reads and crashes. CVE-2026-114598 (7.5) is a type confusion leading to DoS and possible exposure of adjacent memory. All four need only network access to the vulnerable services, typically TCP 5064 (Channel Access) or 5075 (pvAccess), with no authentication or user interaction.
Como funciona
EPICS controllers sit between operators and physical equipment, handling measurements, commands and control functions over the network. Network requests arrive through the Channel Access and pvAccess protocols and are processed by EPICS Base. In the critical flaw, an integer overflow while processing a request leads to a wrongly sized memory allocation, and the attacker-supplied data handled afterwards is written out of bounds on the heap. In the others, message lengths are not validated, reads go past bounds, or malformed data is treated as the wrong type. The articles do not give the exact code paths. The result is a crashed process, leaked nearby memory or, in the worst case, code execution.
Por que é vulnerável
The root causes are memory-safety and input-validation errors in network protocol handling: an unchecked integer overflow in a size calculation, missing message-length validation, insufficient bounds checking and a type confusion. Causal's review of the code history shows the flaws are roughly 14.5 to 31.5 years old, so they sat in the code for a very long time. The articles say this kind of industrial software used to rely on obscurity. They say 7.0.11 includes the fixes but do not describe what changed in the code.
Onde está
The articles tie all four flaws to the handling of the Channel Access and pvAccess protocols in EPICS Base, but name no files, functions or commits.
Como foi descoberta
The flaws were found by Cipher, an autonomous AI agent from Causal Security. Co-founder Shubham Raj says it started with no knowledge of EPICS and found and validated all four in 3 hours 49 minutes. The first phase had no human direction, followed by one instruction authorizing deeper exploitability testing in a secure environment. Per Causal, EPICS maintainers were notified on June 9 and merged patches in July and August. CISA published an advisory on Tuesday, October 27, listing 7.0.10 and earlier as affected. No exploitation has been reported to CISA.
Explicação gerada por IA a partir da matéria e dos artigos, em 28/10/2026 08:16.
Detalhes técnicos
- CVE-2026-114595 (CVSS 3.1 9.8): integer overflow leading to a wrongly sized allocation, an attacker-controlled out-of-bounds heap write and potential remote code execution.
- CVE-2026-114596 (8.2): improper message-length validation causing an out-of-bounds write and controller process crash.
- CVE-2026-114597 (7.5): insufficient bounds checking allowing out-of-bounds reads and process crashes.
- CVE-2026-114598 (7.5): type confusion leading to denial of service and possible exposure of adjacent memory; triggered by malformed network data (securityweek.com).
- All four are tied to the Channel Access and pvAccess protocols and can be triggered without authentication or user interaction, typically over TCP 5064 (Channel Access) or 5075 (pvAccess), via an exposed service or a facility's internal network (securityweek.com).
- Cipher confirmed the heap write and crash using AddressSanitizer (securityweek.com).
- Raj says exploitation would not require deep OT knowledge. Manipulating specific physical processes would need additional domain knowledge, but crashing controllers or interrupting monitoring and control is already operationally damaging. Potential impact includes interrupted particle beams, disrupted experiments, lost monitoring data or expensive shutdowns (securityweek.com).
- The number of internet-facing EPICS deployments is unknown; a brief Censys check found candidates by exposed ports, but none could be verified as EPICS (securityweek.com).
- Per Causal, the flaws are roughly 14.5 to 31.5 years old. EPICS maintainers were notified on June 9 and merged patches in July and August (securityweek.com).
- Earlier this year Cipher also found multiple critical attack paths in power-grid systems in North America and Europe, prompting a CISA advisory on October 8. This month Causal's research also led to disclosures in Grid Protection Alliance's openPDC and openHistorian and in the FreeRTOS-Plus-TCP networking stack (securityweek.com).
Remediação
- Update EPICS Base to version 7.0.11, which includes the fixes.
- Segment control networks so that vulnerable EPICS services (TCP 5064 and 5075) are not reachable from other systems or untrusted networks.
Linha do tempo
-
Four unauthenticated flaws in EPICS Base, incl. CVSS 9.8 CVE-2026-114595, patched in 7.0.11 after CISA advisory
SecurityWeek adds that the advisory covers EPICS Base 7.0.10 and earlier, and that all four flaws are in Channel Access and pvAccess, reachable unauthenticated on TCP 5064 and 5075. It clarifies that RCE was not achieved (only an AddressSanitizer-confirmed heap write and crash) and that no exploitation has been reported to CISA. It also gives the flaws' age (about 14.5 to 31.5 years), the disclosure timeline (maintainers notified June 9, patches merged July and August), and notes that a Censys check could not verify any exposed EPICS hosts.
ler a análise desta fonte ocultar
SecurityWeek adds that the advisory covers EPICS Base 7.0.10 and earlier, and that all four flaws are in Channel Access and pvAccess, reachable unauthenticated on TCP 5064 and 5075. It clarifies that RCE was not achieved (only an AddressSanitizer-confirmed heap write and crash) and that no exploitation has been reported to CISA. It also gives the flaws' age (about 14.5 to 31.5 years), the disclosure timeline (maintainers notified June 9, patches merged July and August), and notes that a Censys check could not verify any exposed EPICS hosts.
CISA published an advisory on four vulnerabilities in EPICS Base 7.0.10 and earlier, the core of an open source toolkit used to build control systems at particle accelerators, fusion experiments and other large research facilities. The most severe, CVE-2026-114595 (CVSS 9.8), is an integer overflow in network request processing that could cause memory corruption, DoS or possibly remote code execution. The flaws were found by Cipher, an autonomous research system from Causal Security, in about 3 hours 49 minutes. All four are tied to the Channel Access and pvAccess protocols and can be triggered without authentication or user interaction. Code execution has not been demonstrated, and no public exploitation has been reported to CISA.
Technical Details
- CVE-2026-114595 (CVSS 9.8): integer overflow leading to a wrongly sized memory allocation, then memory corruption, DoS or possible RCE.
- CVE-2026-114596 (8.2): out-of-bounds write causing instability or DoS.
- CVE-2026-114597 (7.5): out-of-bounds read that can crash the application and leak nearby memory.
- CVE-2026-114598 (7.5): type confusion triggered by malformed network data, leading to DoS.
- Attackers need network access to EPICS services, typically TCP 5064 (Channel Access) or 5075 (pvAccess), via an exposed service or a facility's internal network.
- Cipher demonstrated an attacker-controlled out-of-bounds heap write and process crash using AddressSanitizer; no functional RCE exploit was pursued.
- A brief Censys check found candidate hosts by exposed ports, but none could be verified as EPICS, so the number of internet-facing deployments is unknown.
- Per Causal, the flaws are roughly 14.5 to 31.5 years old. Maintainers were notified on June 9 and merged patches in July and August.
- Causal's research also led to recent disclosures in Grid Protection Alliance's openPDC and openHistorian and in FreeRTOS-Plus-TCP.
Remediation
- Update EPICS Base to version 7.0.11.
- Restrict network access to ports 5064 and 5075 and keep EPICS services off untrusted networks.
-
Autonomous AI agent Cipher finds four EPICS Base flaws, including a CVSS 9.8 RCE, in under four hours
ler a análise desta fonte ocultar
An autonomous AI agent called Cipher, developed by Causal Security, discovered four previously unknown vulnerabilities in EPICS Base (Experimental Physics and Industrial Control System), an open source SCADA toolkit used in about 90 major scientific, university and industrial facilities, including Argonne's Advanced Photon Source and ITER's fusion reactor control system. CISA published an advisory on the flaws, the most severe of which could allow remote code execution. Per Causal Security co-founder Shubham Raj, Cipher found and validated all four in 3 hours 49 minutes, with one human instruction authorizing deeper exploitability testing in a secure environment. The article does not report in-the-wild exploitation. Exploitation requires network reachability to vulnerable EPICS services, which poorly segmented control networks could allow.
Technical Details
- CVE-2026-114595 (CVSS 3.1 9.8): integer overflow leading to an attacker-controlled out-of-bounds heap write and potential remote code execution.
- CVE-2026-114596 (8.2): improper message-length validation causing an out-of-bounds write and controller process crash.
- CVE-2026-114597 (7.5): insufficient bounds checking allowing out-of-bounds reads and process crashes.
- CVE-2026-114598 (7.5): type confusion leading to denial of service and possible exposure of adjacent memory.
- Raj says exploitation would not require deep OT knowledge. Manipulating specific physical processes would need additional domain knowledge, but crashing controllers or interrupting monitoring and control is already operationally damaging.
- Earlier this year Cipher also found multiple critical attack paths in power-grid systems in North America and Europe, prompting a CISA advisory on October 8.
Remediation
- Update EPICS Base to version 7.0.11, which includes the fixes.
- Segment control networks so that vulnerable EPICS services are not reachable from other systems or untrusted networks.