In EPICS Base release 7.0.10 and prior, an integer overflow in network request processing can cause memory to be allocated with an incorrect size
At a glance
Medium rather than High: exposure is scored at a default because we cannot see your systems or suppliers.
Briefing
There is no written leader briefing for this story yet. These questions come from the facts we hold.
Questions to ask IT
- Are we affected by CVE-2026-114595, CVE-2026-114596 or 2 more, and which of our systems would be?
- If it is still not patched, what mitigation is in place, and what is holding the fix up?
Next steps
- Confirm whether this affects systems or suppliers in your estate
Vulnerability facts
Full CVE detail CVE-2026-114595- 9.3 · CriticalExploitable over the network without any account, and no one has to click or open anything. High impact on confidentiality, integrity and availability.CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Not listed
- 7.0.10 and earlier
- Not linked from the CVE record
These facts are for CVE-2026-114595. This event covers 3 more CVEs, each with its own record.
No technical write-up beyond these facts and the summary below yet.
Next steps
- Review the advisory against your asset inventory and patch cadence
Summary
- View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to cause a denial-of-service condition, corrupt memory, disclose sensitive information, or potentially execute arbitrary code.
Read the original reportCISA Cybersecurity Advisories(opens in a new tab)
Pulse
Last change 3 Nov · Recheck overdue since 4 Nov 2026, 12:04 UK time
- Story3 Nov 2026, 12:04 UK time · 3 Nov
Linked reporting from CISA Cybersecurity Advisories (official authority).
Read source (CISA Cybersecurity Advisories) - Story3 Nov 2026, 12:04 UK time · 3 Nov
Linked reporting from CISA ICS Advisories (official authority).
Read source (CISA ICS Advisories)
2 entries so far. The timeline chart appears once this story has more history.
Sources
- CISA Cybersecurity AdvisoriesOfficial
EPICS Base
- CISA ICS AdvisoriesOfficial
EPICS Base
How we know
Statements extracted from sources. Higher confidence means stronger corroboration.
- ClaimedHeadline60% confidence
In EPICS Base release 7.0.10 and prior, an integer overflow in network request processing can cause memory to be allocated with an incorrect size
- ProbableSummary fact75% confidence
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to cause a denial-of-service condition, corrupt memory, disclose sensitive information, or potentially execute arbitrary code.
- ConfirmedCVE identifier95% confidence
Event involves CVE-2026-114595
- ConfirmedCVE identifier95% confidence
Event involves CVE-2026-114596
- ConfirmedCVE identifier95% confidence
Event involves CVE-2026-114597
- ConfirmedCVE identifier95% confidence
Event involves CVE-2026-114598