CISA: four vulnerabilities in EPICS, software that controls accelerators and fusion facilities; fix released in version 7.0.11
Prepared by Sintelligent with the help of SI. Published in SI: . Updated: .
An SI agent found four vulnerabilities in software that controls scientific equipment in under four hours, The Register reports.
The US agency CISA published advisory ICSA-26-300-01 on four vulnerabilities (CVE-2026-114595 to CVE-2026-114598) in EPICS Base version 7.0.10 and earlier, an open-source toolkit for systems that control scientific equipment, including particle accelerators and fusion experiments. Successful exploitation could lead to denial of service, memory corruption, disclosure of data or execution of arbitrary code; the fix is in version 7.0.11, released the same day. The research is credited to Shubham Raj of Cipher / Causal Security. According to Crypto Briefing's retelling of The Register's report, an autonomous SI agent made the find; The Register's headline gives the time as under four hours.