CISA Warns GENESIS and ICONICS Users: Version 10.97.3 Doesn't Fix All Vulnerabilities
CISA advisory ICSA-26-300-02 covers flaws in Mitsubishi Electric and ICONICS. Version 10.97.3 is not enough; three 2026 flaws need ICONICS Suite 10.98.
Vulnerabilities
EPICS Base Vulnerabilities: CISA Warns of Four Flaws in Control System Software, Patch to 7.0.11
CISA warns of four EPICS Base flaws, including possible remote code execution. Update to 7.0.11 and check network access to your control systems.
On October 27, CISA issued an advisory about four vulnerabilities in EPICS Base. The most serious, CVE-2026-114595, can lead to memory corruption, a service crash or, potentially, code execution. Version 7.0.11 fixes all four. There is no confirmation that any of them has been exploited in attacks.
What Was Disclosed
EPICS is used to build control and supervisory systems. In these environments, the software’s availability affects how connected equipment runs. Advisory ICSA-26-300-01 covers EPICS Base 7.0.10 and earlier releases.
CVE-2026-114595 is an integer overflow in the handling of network requests. The software can calculate the wrong size for a memory allocation, and that can corrupt memory. The flaw has a CVSS 3.1 score of 9.8.
The other three issues involve how message lengths and message elements are validated. They can cause out-of-bounds writes or reads, crash the process and, in some cases, disclose information. The advisory alone does not mean that any particular installation has been breached.
What to Do Now
Coordinate the following steps with the people responsible for equipment maintenance and operational continuity:
- Identify where EPICS Base is running, which versions are deployed and who owns the updates.
- Plan the rollout of release 7.0.11, accounting for control system dependencies.
- Check whether the services can be reached from the internet or from networks that should not have access to them.
- Restrict traffic with firewalls and separate the control network from the office network.
- After deployment, verify that processes are running correctly and keep a record of the change.
Updates in a control environment need compatibility testing. Restricting network access can reduce exposure while you prepare the rollout, but it does not remove the vulnerable code.
SecurHUB’s Take
An inventory of control software should also cover community-developed libraries and components. An infrastructure security audit helps assess network access, who is responsible for what and how patches are rolled out in these environments.
Sources: CyberStack, GitHub Advisory Database, JVN
