Reported information
EPICS: four AI-discovered flaws have available fixes
Causal Security disclosed four flaws in EPICS Base scientific control software on 27 October 2026. Version 7.0.11 fixes them; the most serious, CVE-2026-114595, is rated 9.8 out of 10.
The company says its Cipher agent found the flaws in 3 hours and 49 minutes, with one human authorization for deeper testing in an isolated environment. The Register interviewed its cofounder and also reports CISA's warning.
Exploitation requires reaching vulnerable EPICS services on a control network. Risks include process crashes, memory disclosure and possible code execution, which Cipher did not demonstrate. Operators are advised to install 7.0.11 or backported fixes and restrict network access.