CISA published ICS advisory ICSA-26-300-01 on Oct 27 for EPICS Base, the open-source control-system framework used in particle accelerators, telescopes, research labs and some manufacturing. Releases 7.0.10 and earlier have four flaws (CVE-2026-114595 to CVE-2026-114598): an integer overflow in network request handling, inconsistent length handling and a type confusion. CISA says they could cause denial of service, memory corruption, information disclosure or possibly remote code execution, and lists a top CVSS v3 score of 9.8.

What to do: update to EPICS Base 7.0.11. Keep Channel Access and PV Access ports off untrusted networks, and put EPICS IOCs behind firewalls apart from business networks.