Causal Security's Cipher AI found 4 EPICS Base flaws in under 4 hours, CISA advisory confirms

What CISA and Causal Security disclosed

CISA released ICS advisory ICSA-26-300-01 on 27 October 2026 for EPICS Base, the core of the Experimental Physics and Industrial Control System. The advisory covers four vulnerabilities in release 7.0.10 and earlier. CISA says successful exploitation could cause denial of service, corrupt memory, disclose sensitive information or potentially allow arbitrary code execution. It lists Critical Manufacturing as the affected sector, with deployment worldwide.

The advisory credits Shubham Raj of Cipher and Causal Security. In a research post the same day, Causal Security says Cipher, its autonomous security system, found all four flaws in 3 hours and 49 minutes, starting from a codebase it had not seen before. The company says the only human step was a single instruction authorizing deeper exploitability testing in an isolated sandbox. Causal Security says EPICS components run at particle accelerators, synchrotron light sources, major telescopes and fusion experiments, and form part of the control-system architecture of the ITER fusion project.

The four flaws

Three bugs sit in server-side handling of Channel Access messages and one in pvAccess deserialization. CVE-2026-114595, rated 9.8, is an integer overflow when sizing a write request that produced a heap-buffer-overflow write in Cipher's sandbox. Causal Security says remote code execution is a potential consequence but that Cipher did not demonstrate it. CVE-2026-114596, rated 8.2, is a length overflow that leads to a constrained out-of-bounds write. CVE-2026-114597 and CVE-2026-114598, both 7.5, cause out-of-bounds reads and crashes.

The EPICS community fixed the bugs in EPICS Base 7.0.11. Causal Security advises operators to restrict access to IOC network services, noting that Channel Access uses TCP 5064 and pvAccess TCP 5075 by default, and says neither access-security rules nor network segmentation replace the fixes. CISA says no known public exploitation has been reported.

Why it matters

This is the second CISA advisory in October to credit Cipher, after ICSA-26-281-02 on 8 October covered six flaws in Grid Protection Alliance's openPDC and openHistorian energy software. AI systems are now finding critical bugs in niche industrial software that rarely gets audited, faster than maintainers can usually review them. That helps defenders who patch quickly, but the same capability is available to attackers, as Google's analysis of AI-driven vulnerability discovery has described. More coverage is in Cybersecurity.

What to watch next

Facilities running EPICS often patch slowly because control systems cannot easily be taken offline. Downstream distributions that embed EPICS components may need their own updates, which the advisory does not list. Causal Security says it coordinated the disclosure with the EPICS maintainers and CISA, so the fixes were ready before publication.

Questions people ask

Which EPICS versions are affected?

EPICS Base release 7.0.10 and earlier, according to CISA. The fixes are in release 7.0.11.

Did an AI really find these vulnerabilities?

CISA credits Shubham Raj of Cipher and Causal Security. Causal Security says its autonomous system Cipher found and validated all four in 3 hours and 49 minutes without human intervention beyond authorizing deeper testing.

Are the EPICS flaws being exploited?

CISA says no known public exploitation specifically targeting these vulnerabilities has been reported to it.

Sources

1. Inside EPICS Base: Four severe vulnerabilities discovered autonomously in under four hours (Causal Security (Cipher Research), 27 Oct 2026)
2. ICSA-26-300-01: EPICS Base (Cybersecurity and Infrastructure Security Agency (CISA), 27 Oct 2026)
3. ICSA-26-300-01 CSAF advisory file (CISA on GitHub, 27 Oct 2026)