A security fix with an operational condition

EPICS Base 7.0.11 addresses four vulnerabilities disclosed by CISA on October 27, but the project’s release notice adds a qualification for operators: interoperability between its Channel Access server and older client programs has not been tested. That makes the installed client population part of the remediation decision.

Different defects, different consequences

CISA identifies Base 7.0.10 and earlier as affected. The most severe issue, CVE-2026-114595, involves an incorrect memory allocation during network-request processing and could permit code execution. Other issues can cause crashes or expose memory. CISA says it had received no reports of public exploitation specifically targeting these flaws when it issued the advisory.

Research does not establish a facility compromise

Causal Security, which reported the vulnerabilities, says its Cipher system reproduced crashes in isolated testing. It did not demonstrate remote code execution. The company describes EPICS as software used to build control systems for scientific instruments, including accelerators and fusion experiments; it does not report an attack on those facilities.

Maintainers put legacy integration in view

CISA classifies the affected deployment sector as critical manufacturing and recommends the new release. The maintainers’ warning adds an implementation issue for organizations operating customized control systems: security validation and application compatibility are separate questions. A successful software update alone cannot settle whether older clients still communicate as expected. Conversely, compatibility uncertainty does not resolve the disclosed vulnerabilities. The release provides a concrete fix, with production testing explicitly left to the sites that know their equipment and integrations.

Sources & further reading

Our practical suggestions are editorial guidance. Verify applicability against current source and vendor instructions.

Manufacturing
Suggest a correction →