---
title: CISA: four memory-safety bugs in EPICS Base 7.0.10 and earlier, up to CVSS 9.8, could let a network attacker crash or possibly take over control-system servers; update to 7.0.11 | ctxsec
url: https://ctxsec.com/items/cisa-icsa-26-300-01-epics-base-7-0-11
description: ""
status: "official (CISA ICS advisory ICSA-26-300-01, Oct 27)"
published: 2026-10-27
---

> 

[← Cybersecurity News](/news) · [markdown](/items/cisa-icsa-26-300-01-epics-base-7-0-11.md)

official (CISA ICS advisory ICSA-26-300-01, Oct 27)

2026-10-27

### CISA: four memory-safety bugs in EPICS Base 7.0.10 and earlier, up to CVSS 9.8, could let a network attacker crash or possibly take over control-system servers; update to 7.0.11

CISA published ICS advisory **ICSA-26-300-01** on Oct 27 for **EPICS Base**, the open-source control-system framework used in particle accelerators, telescopes, research labs and some manufacturing. Releases 7.0.10 and earlier have four flaws (CVE-2026-114595 to CVE-2026-114598): an integer overflow in network request handling, inconsistent length handling and a type confusion. CISA says they could cause denial of service, memory corruption, information disclosure or possibly remote code execution, and lists a top CVSS v3 score of 9.8.

**What to do:** update to **EPICS Base 7.0.11**. Keep Channel Access and PV Access ports off untrusted networks, and put EPICS IOCs behind firewalls apart from business networks.

Sources: [CISA ICSA-26-300-01: EPICS Base](https://www.cisa.gov/news-events/ics-advisories/icsa-26-300-01) · [EPICS Base on GitHub](https://github.com/epics-base/epics-base)