The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned Tuesday of four severe flaws in EPICS Base, open-source software used to run equipment at scientific facilities and industrial sites, in an advisory crediting a researcher whose company says an autonomous AI system found them in under four hours. For operators of labs and plants, the case shows how quickly AI tools can now dig into control software that is slow and costly to patch.
What Happened
The advisory covers EPICS Base release 7.0.10 and earlier. The worst flaw, CVE-2026-114595, is an integer overflow, a math error that leads the software to reserve the wrong amount of memory. It scores 9.8 out of 10 on the Common Vulnerability Scoring System and could allow remote code execution, meaning an attacker runs their own commands on the system. The other three, rated High, can crash processes or expose nearby memory contents.
Version 7.0.11 includes the fixes for all four, The Register reported. CISA said no known public exploitation targeting the flaws had been reported to it.
CISA credited Shubham Raj of Cipher / Causal Security. Raj, a co-founder of Causal Security, told The Register that its Cipher system investigated the unfamiliar software and validated all four exploits in 3 hours and 49 minutes. He said the initial investigation needed no human intervention, and that a single instruction then authorized deeper testing in a secure environment.
EPICS was originally developed at Los Alamos and Argonne national laboratories and is used in about 90 major scientific, university and industrial projects, including Argonne's Advanced Photon Source and the ITER fusion reactor's control system, The Register reported.
Why It Matters
An attacker needs network access to a facility's EPICS services, which weak segmentation or a connected system could provide. Raj told The Register that someone with conventional exploitation skills could investigate the flaws, though manipulating specific physical processes would require additional knowledge. Crashing a controller could still halt an experiment or interrupt monitoring.
For boards and executives overseeing research or industrial operations, the lesson is timing. Control systems often run for years between upgrades, while AI tools are shrinking the time needed to find their weaknesses. The Primary Wire reported Saturday, citing AFP, that former White House cyber coordinator Michael Daniel expects a stream of AI-found flaws to force faster patching.
CISA urges keeping control devices off the internet, behind firewalls and separate from business networks, with remote access only through updated virtual private networks (VPNs).
What to Watch
Watch for exploitation reports, how quickly facilities move to 7.0.11 and whether more CISA advisories credit AI tools. The Register reported that Cipher's earlier findings in North American and European power-grid systems led to a CISA advisory Oct. 8.
