EPICS Base Software Receives Critical Security Update
The patch resolves four vulnerabilities in versions 7.0.10 and earlier to prevent unauthorized code execution.
Updated on Oct. 27, 2026 in Cybersecurity
Live Poll
Do you trust software developers to notify you promptly about critical security vulnerabilities in their products?
The EPICS Community has released security updates for EPICS Base software versions 7.0.10 and earlier. This update addresses four critical vulnerabilities that could allow for unauthorized code execution or denial-of-service conditions.
Why it matters
EPICS Base is widely used for industrial and experimental control systems, making these vulnerabilities a priority for operators who need to secure their infrastructure against potential memory corruption or information disclosure exploits.
The patch addresses four vulnerabilities (CVE-2026-114595, CVE-2026-114596, CVE-2026-114597, and CVE-2026-114598) present in all EPICS Base iterations through version 7.0.10. Operators are required to upgrade to version 7.0.11 to mitigate risks including memory corruption and arbitrary code execution.
The players
EPICS Community
The open-source development group managing the Experimental Physics and Industrial Control System (EPICS) software framework used globally in control systems.
Shubham Raj
A researcher at Cipher / Causal Security who identified and reported the four vulnerabilities affecting the EPICS Base platform.
The details
The EPICS Base software architecture serves as an open-source toolset for creating distributed control systems, often found in large-scale scientific facilities. The identified vulnerabilities reside within the base codebase, allowing an attacker to manipulate memory or force a crash—a denial-of-service (DoS) condition—if successfully exploited. By updating to the 7.0.11 release, administrators replace the compromised modules in their GitHub repository deployments to close these specific access vectors.
Timeline
October 27, 2026: The EPICS Community published the initial security advisory.
The Tech Race
The EPICS Base software ecosystem frequently undergoes security hardening as the platform remains a standard for international scientific research infrastructure. This update follows a pattern of proactive patching to prevent the exploitation of memory-related vulnerabilities in complex, distributed industrial systems.
Operators running versions 7.0.10 or earlier must initiate an immediate update to the 7.0.11 release to secure their systems. No public instances of exploitation have been confirmed, but administrators should verify their versioning on the relevant GitHub repositories.
The takeaway
Maintaining the security of distributed control systems requires constant monitoring of the EPICS Base GitHub repository for official patch releases. Operators should prioritize the upgrade to version 7.0.11 immediately to address these four specific vulnerability identifiers.
Further reading
For broader technical standards in control systems, see our Cybersecurity section.
More information
Administrators can verify the patch requirements and download the latest version through the EPICS Controls team support page.
Live Poll
Do you trust software developers to notify you promptly about critical security vulnerabilities in their products?
