Four significant vulnerabilities have been identified and patched in the EPICS Base software, which is crucial for control systems in particle accelerators and fusion experiments. These flaws, if exploited, could severely disrupt operations in large research facilities, with one of them potentially allowing unauthorized code execution.
CISA Advisory on EPICS Base Vulnerabilities
The Cybersecurity and Infrastructure Security Agency (CISA) issued a warning regarding these vulnerabilities, which affect EPICS Base versions up to 7.0.10. Users are urged to upgrade to version 7.0.11 to mitigate these security risks. The discovery was made by Cipher, an autonomous security research tool developed by Causal Security.
EPICS, an open-source toolkit, is integral to the control systems of numerous scientific facilities. It is the foundation for systems like ITER’s fusion reactor and the Advanced Photon Source at Argonne National Laboratory. The most severe vulnerability, identified as CVE-2026-114595, involves an integer overflow with a critical CVSS score of 9.8. This flaw can cause incorrect memory allocation, leading to potential memory corruption and denial-of-service (DoS) attacks.
Details of the Vulnerabilities
Additional vulnerabilities include CVE-2026-114596, which can lead to out-of-bounds writes destabilizing processes or causing DoS, and CVE-2026-114597, which may crash applications and expose data due to out-of-bounds reads. The CVE-2026-114598 vulnerability involves type confusion, which can also result in DoS attacks when network data is malformed.
All of these issues are linked to the Channel Access and pvAccess protocols used by EPICS for network communication. Shubham Raj, co-founder of Causal Security, highlighted that these vulnerabilities can be exploited without user authentication or interaction, requiring only network access to vulnerable services over specific TCP ports.
Impact on Research Operations
Potential exploitation of these vulnerabilities could severely impact research operations, causing interruptions in particle beams and experiments, data loss, and costly equipment shutdowns. Although code execution has not been realized, Cipher’s tests demonstrated critical vulnerabilities that could lead to heap memory corruption and process crashes.
Despite the gravity of these vulnerabilities, no public exploitation has been reported. The vulnerabilities were identified rapidly, within just under four hours, with Cipher having no prior EPICS-specific attack knowledge. The flaws were reported to EPICS maintainers in June, with patches issued in July and August.
Conclusion and Future Outlook
The swift identification and patching of these vulnerabilities underscore the importance of proactive cybersecurity measures in research facilities. As these systems are crucial to scientific advancements, ensuring their security is paramount. Causal Security’s findings also contributed to security disclosures in other critical infrastructures, highlighting the ongoing need for vigilance in cybersecurity.
