What did Cipher find in EPICS Base?
On 27 October 2026, the US Cybersecurity and Infrastructure Security Agency published advisory ICSA-26-300-01. It covers four memory-safety vulnerabilities in EPICS Base, the central component of the Experimental Physics and Industrial Control System. Every version up to and including 7.0.10 is affected.
The flaws were not found by a human audit team working through the code line by line. Cipher, an autonomous security system built by Causal Security, discovered and validated all four in 3 hours and 49 minutes. It started with no knowledge of EPICS.
Three of the bugs sit in the server-side parsing and handling of Channel Access messages. The fourth affects deserialization in the classic pvAccess implementation. All four are reachable over the network, and none requires a privileged account or user interaction.
CISA describes the potential impact in broad terms. Successful exploitation could cause a "denial-of-service condition, corrupt memory, disclose sensitive information, or potentially execute arbitrary code", the advisory says.
These are memory-safety defects, a class of bug that remains common in C and C++ code. EPICS Base is written in those languages, and its release notes describe debugging C/C++ code inside an IOC. The flaws are not errors in physics calculations. They are failures to check the size and type of data arriving from the network.
- •CVE-2026-114595: an integer overflow when sizing a Channel Access write request. CVSS 9.8, critical. A crafted request can cause an out-of-bounds heap write and a crash.
- •CVE-2026-114596: an extended-header length overflow in Channel Access. CVSS 8.2, high. It causes a constrained out-of-bounds write and a crash.
- •CVE-2026-114597: an unchecked element count in Channel Access. CVSS 7.5, high. It produces an out-of-bounds read and a crash.
- •CVE-2026-114598: a type confusion during pvAccess connection validation. CVSS 7.5, high. It leads to an out-of-bounds read and a server-thread crash.
Why do EPICS Base flaws matter for accelerators and fusion labs?
EPICS is not consumer software. It is an open-source framework for building distributed control systems that operate particle accelerators, synchrotron light sources, large telescopes and fusion experiments. Los Alamos National Laboratory and Argonne National Laboratory originally developed it, and it is now maintained by an international collaboration under a BSD-style licence.
The scale is significant. The Register reports that EPICS is used in around 90 major scientific, university and industrial projects and facilities worldwide. The EPICS project's own documentation says the Advanced Photon Source at Argonne uses EPICS extensively, with 800 input/output controllers monitoring and controlling almost every aspect of the machine. ITER says its CODAC control system, which connects more than 30 plant systems and handles about one million signals, is built on EPICS.
ITER is the clearest example of why that reach matters. The project describes CODAC as the brain and central nervous system of the machine, linking plant systems that generate and exchange about one million signals. The control system supports a machine designed to produce 500 MW of fusion power at a gain factor of Q of at least 10. A parser bug in that path is not an abstract software defect.
An EPICS input/output controller, or IOC, sits between operators and physical equipment. It handles measurements, commands and control functions. Crashing one does not merely take a web page offline. It can interrupt a beam, halt a measurement run or force operators to stop an experiment that took months to prepare.
Shubham Raj, co-founder of Causal Security, gave The Register a concrete example. Imagine a particle accelerator in the middle of an expensive experiment, he said. An attacker could crash a controller, interrupt critical measurements and force a shutdown, with lost work, downtime and expensive recovery.
The defects are old. Cipher's review of the code history found that the flaws are between roughly 14.5 and 31.5 years old, according to SecurityWeek. They survived because scientific control software has often been protected by network isolation rather than by rigorous parser testing.
CISA lists the vulnerable product under the critical manufacturing sector and says it is deployed worldwide. That classification matters. These are systems where a software fault can have physical consequences.
How did an AI agent find four vulnerabilities in under four hours?
Causal Security describes Cipher as an autonomous system that investigates unfamiliar software and infrastructure, including code with no documentation. It forms hypotheses about memory handling and tests them by running the software in an isolated sandbox.
On EPICS, the system traced each network-controlled count, length and decoded type to the point where it sizes an allocation, indexes memory or casts a pointer. It built the affected components and reproduced all four bugs under AddressSanitizer or a debugger. Each reproduction was checked against a negative control to separate a real fault from normal protocol behaviour.
Crash-only findings are cheap; validated ones are not. Cipher's report identifies the specific validation failure that each patch closes, and the upstream pull requests acknowledge the confidential report. That traceability is what separates a usable vulnerability report from a scanner alert, and it is why the maintainers could ship fixes rather than a warning.
The process was not entirely hands-off. The initial investigation required no human intervention, Raj told The Register. A single instruction then authorised deeper exploitability testing in a secure environment. That distinction matters when vendors describe AI security tools as fully autonomous.
The disclosure timeline was conventional. Causal reported the issues to the EPICS security channel on 9 June 2026. The Channel Access fix was merged in pull request 934 on 23 July, and the pvDataCPP fix followed in pull request 109 on 10 August. EPICS Base 7.0.11 and the CISA advisory were published on 27 October, about 20 weeks after the initial report.
This is not Cipher's first industrial finding. On 15 October, Causal published research on six vulnerabilities in Grid Protection Alliance's openPDC and openHistorian, two of them critical, in software used to monitor power grids. SecurityWeek also links the company's work to disclosures in the FreeRTOS-Plus-TCP embedded networking stack. The Register connects Cipher to earlier attack-path findings in power-grid systems across North America and Europe, which prompted a CISA advisory on 8 October.
Raj characterised the system to The Register as "a fully autonomous super hacker that can reason across the technology stack". That is a vendor's description, and it should be read as such. The evidence for the EPICS work is stronger than the marketing language: CISA assigned CVEs, the maintainers merged patches, and the fixes are public.
Can CVE-2026-114595 be exploited over the network?
In principle, yes, if an attacker can reach the service. "All four can be triggered without authentication or user interaction," Raj told SecurityWeek. The Channel Access flaws need a normal TCP connection to port 5064. The pvAccess flaw is reached during connection validation on port 5075. UDP ports 5064 and 5076 carry discovery traffic.
The CVSS 9.8 score for CVE-2026-114595 reflects that network reach and the potential impact. The vector describes a network-reachable flaw with low attack complexity, no privileges required and no user interaction. Confidentiality, integrity and availability impacts are all rated high.
A score is not a demonstration. Cipher showed an attacker-influenced heap-buffer-overflow write and a process crash under AddressSanitizer. It did not build a working remote code execution exploit, and it did not test reliability against production builds. CISA says code execution is possible in principle. Neither CISA nor Causal says it has been achieved.
Exposure is also unclear. Raj told SecurityWeek that a brief Censys check found candidate hosts based on open ports, but none could be confirmed as running EPICS. Many facilities keep controllers on segmented control networks that are not reachable from the internet. That reduces the risk without eliminating it, because flat networks and remote-access paths exist.
The required skill level is the part that worries defenders. Raj argued that an attacker would not need deep operational technology knowledge or an understanding of accelerator physics. "Someone with conventional exploitation skills could investigate them," he told The Register, and increasingly capable AI systems could help develop exploits.
No public exploitation had been reported to CISA as of SecurityWeek's 28 October report. The immediate risk is therefore theoretical but credible: a critical memory-corruption bug in software that controls expensive physical equipment, with patches available and exposure unmeasured.
The population at risk is narrower than the internet but deeper than one product. EPICS is a framework, so the vulnerable code can arrive through a facility's own build, a laboratory's distribution or a commercial vendor's packaged control system. An operator may not know that EPICS Base 7.0.10 sits inside a subsystem until someone inventories the dependencies. That is why Causal's guidance covers downstream maintainers as well as end users.
What should EPICS operators do now?
The first step is an inventory. Operators should identify every EPICS Base deployment, including vendor-supported distributions and custom-built IOCs that embed the affected Channel Access or pvAccess code. The fixed release is EPICS Base 7.0.11, which CISA recommends. Facilities that cannot upgrade immediately should ask vendors for backported fixes.
Network controls still matter. Causal advises restricting Channel Access and pvAccess services to the control hosts and networks that need them. Operators should look for unexpected paths across management, remote-access, research, guest or bridged segments. Those steps reduce exposure, but they do not fix the parsing bugs.
Access-security rules are not a substitute for patching, either. EPICS supports IOC access-security rules and pvAccess authentication, but those controls govern what a client may read or write. They do not make a malformed message safe to parse. The pvAccess flaw is reached before the authentication exchange completes.
The upgrade carries its own operational risk. The 7.0.11 release notes say the Channel Access server now validates messages more strictly in response to several independent vulnerability reports. "These changes introduce an added risk of interoperability issues with older CA clients," the notes warn. Sites using older libca or CAJ versions, or other client implementations, are advised to test before deploying.
Vendors and downstream maintainers have work to do as well. They should confirm whether their packaged EPICS components include the affected code, whether the fixes from pull request 934 and pvDataCPP pull request 109 are present, and publish version-specific guidance for customers who cannot adopt the full upstream release.
For facilities that cannot patch quickly, the practical options are segmentation, monitoring and reducing the number of reachable services. CISA directs users to the EPICS Controls team for support. None of these measures is a permanent answer to a memory-safety flaw in a network parser.
Patch management in this sector is slow for good reasons. Control systems are validated against experiments, certifications and safety cases, and a change to network parsing can affect clients that have run unchanged for a decade. The 7.0.11 interoperability warning is not a minor footnote; it is why some sites will wait, test and backport rather than upgrade immediately.
What does this mean for AI vulnerability research?
The headline number is the speed. A codebase that a human team might study for weeks was mapped, tested and documented in under four hours. That changes the economics of finding bugs in older open-source software, especially code that has been kept safe by obscurity and isolation rather than by review.
The limits are just as important. Cipher worked inside a sandbox with sanitizers, not against a live accelerator. It proved memory corruption and crashes, not reliable code execution. Its operator authorised the deeper testing phase. And the finding still went through a conventional coordinated disclosure process that took about 20 weeks from report to advisory.
Older code is fertile ground for this kind of tool. Bugs that survived decades of use were often hidden behind assumptions about who could reach the service. Once an agent can build the software, send malformed messages and check the result, those assumptions stop protecting anything.
The defender's problem is now patch throughput. AI tools can generate more valid findings than many small maintainer teams can triage, fix, test and backport. EPICS has a mature international collaboration and a security channel, which helped. Less organised projects may not fare as well.
There is also a policy question. If autonomous systems can find critical bugs in critical infrastructure software at this rate, the bottleneck moves from discovery to remediation and from remediation to deployment at facilities with multi-year upgrade cycles.
Regulators have not settled how AI-discovered vulnerabilities should be disclosed. The EPICS case followed the familiar pattern: private report, CVE assignment, coordinated advisory and public patches. That worked because the maintainers responded quickly. A faster discovery pipeline will test whether the rest of the ecosystem can keep up.
Watch for CISA to add these CVEs to its Known Exploited Vulnerabilities catalogue if exploitation appears. Watch vendor advisories for backports, particularly from companies that ship EPICS-based control systems. Watch whether scans find exposed Channel Access or pvAccess services. And watch the next Causal disclosure, because the pattern is now established.
The fixes exist and the advisory is public. The open question is how quickly 90 facilities, their suppliers and their legacy clients move to 7.0.11 without breaking the control rooms they depend on.