An autonomous AI agent identified four vulnerabilities within the EPICS toolkit, an open-source system used to manage particle accelerators and fusion experiments. The findings were detailed in a CISA advisory, ICSA-26-300-01, published on October 27, 2026.
The affected software includes EPICS Base version 7.0.10 and earlier. The vulnerabilities, tracked as CVE-2026-114595 through CVE-2026-114598, could potentially allow remote code execution, memory corruption, or denial-of-service attacks.
One of the identified flaws is classified as critical, while CVE-2026-114598 is a high-severity type confusion issue with a CVSS score of 7.5/8.7. CISA reports no evidence of public exploitation of these vulnerabilities to date.
The research was conducted by Shubham Raj of Cipher / Causal Security. To address the security risks, maintainers released EPICS Base version 7.0.11 on the same day the advisory was issued.
