CISA has published an advisory covering four flaws in EPICS Base, the open-source toolkit underpinning control systems at particle accelerators, fusion experiments and similar facilities, including ITER’s reactor project.
Cipher, an autonomous research system built by Causal Security, found them. EPICS Base 7.0.10 and earlier is exposed; 7.0.11 removes the risk.
The headline bug is CVE-2026-114595, scored 9.8. The flaw is an integer overflow in the path that parses incoming requests. CISA says it can yield a wrongly sized allocation; later handling of attacker data could corrupt memory, knock a process over or open a route to executing code.
The rest of the set
CVE-2026-114596, at 8.2, is an out-of-bounds write that leaves a process unstable or takes it down. CVE-2026-114597, rated 7.5, is an out-of-bounds read that can crash an application and spill nearby memory contents. The fourth, also 7.5, is a type confusion flaw reachable with malformed network data and used to cause denial of service.
Argonne National Laboratory’s Advanced Photon Source leans on it heavily, so affected installations sit where downtime is expensive and physical processes are under active control.
What operators should do
Patch to 7.0.11 as the direct remedy. Where an upgrade needs a maintenance window, review how widely 5064/TCP is reachable from control networks and whether engineering workstations that speak to EPICS can be touched from general IT segments.
The finding also matters as a data point about machine-driven discovery. A system that started with no knowledge of EPICS took about three hours and 49 minutes to surface all four flaws, part of a wider acceleration in disclosure that leaves asset owners clearing patch queues faster than most change-control processes were built to handle.
