An autonomous AI agent has found four vulnerabilities in EPICS, the open source toolkit that helps run particle accelerators and fusion experiments, according to a report from The Register.
One of the flaws is described as critical. It could let a remote attacker execute code on the machines that control some of the most expensive scientific equipment on Earth.
The US Cybersecurity and Infrastructure Security Agency (CISA) flagged the issues in a Tuesday advisory. A fix is already available.
What CISA found in EPICS
EPICS stands for Experimental Physics and Industrial Control System. It has been maintained for decades and underpins distributed control systems across a range of sectors.
CISA’s advisory, ICSA-26-300-01, was published on October 27, 2026. It covers four vulnerabilities tracked as CVE-2026-114595 through CVE-2026-114598.
The affected software is EPICS Base version 7.0.10 and earlier. CISA places the impacted systems under the Critical Manufacturing sector.
“Successful exploitation of these vulnerabilities could allow an attacker to cause a denial-of-service condition, corrupt memory, disclose sensitive information, or potentially execute arbitrary code,” CISA warned.
The type confusion flaw, explained
The most detailed of the four is CVE-2026-114598, a high-severity type confusion flaw. It carries a CVSS score of 7.5/8.7.
In this case, that mismatch can crash the system, causing a denial of service. It could also expose adjacent memory contents, meaning data sitting next to the target in memory may leak out to whoever triggered the bug.
The separate critical flaw is the one that raises the stakes further. Per The Register’s reporting, it could allow remote attackers to run their own code on systems used to control accelerators and fusion experiments.
Patch available, no known attacks yet
The good news is that maintainers moved quickly. EPICS Base version 7.0.11, which addresses the vulnerabilities, was released on the same date as the CISA advisory.
CISA also stated that it has received no reports of public exploitation of these specific flaws as of the advisory’s release.
The research behind the advisory is attributed to Shubham Raj of Cipher / Causal Security. The disclosure was coordinated, which is why a patch landed alongside the warning rather than weeks after it.
The CISA advisory itself credits the researcher and does not discuss the tools used. The Register’s account describes the discovery as the work of an autonomous AI agent.
Disclosure: This article was edited by Diego Almada Lopez. For more information on how we create and review content, see our Editorial Policy.