EPICS Base CVE-2026-114595–598: Critical ICS Flaws Enable RCE — Detection and Remediation Guide

---
title: Anomalous EPICS Channel Access Network Connections
description: Detects unexpected network connections to EPICS Channel Access ports from non-standard hosts, potentially indicating exploitation attempts against CVE-2026-114595-598.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-300-01
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.exploitation
title: EPICS IOC Process Spawned Unexpected Child Process
id: 8e4d2c5f-1b3a-4f6e-9c7d-2a8b5e1f4c6d
status: experimental
description: Detects an EPICS IOC process (st.cmd, softIoc, iocBoot) spawning shell interpreters or command execution tools, a strong indicator of post-exploitation activity following memory corruption.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-300-01
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|contains:
      - 'st.cmd'
      - 'softIoc'
      - 'iocBoot'
      - 'caget'
      - 'camonitor'
  selection_child:
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/dash'
      - '/zsh'
      - '/nc'
      - '/ncat'
      - '/python'
      - '/python3'
      - '/perl'
      - '/wget'
      - '/curl'
  condition: selection_parent and selection_child
falsepositives:
  - IOC startup scripts may legitimately invoke shell commands during initialization; tune against known-good st.cmd scripts.
  - CA client tools (caget, caput) may spawn helper scripts in some deployments.
level: high
---
title: EPICS IOC Unexpected Process Crash or Core Dump
id: 3c7a1e9f-6d2b-4f8a-bc5e-9d4f2a6c8b1e
status: experimental
description: Detects EPICS-related processes crashing or generating core dumps, which may indicate exploitation attempts triggering memory corruption vulnerabilities (CVE-2026-114595-598).
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-300-01
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.exploitation
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    CommandLine|contains:
      - 'abrt-hook'
      - 'systemd-coredump'
      - 'apport'
      - 'drkonqi'
    CommandLine|contains:
      - 'ioc'
      - 'epics'
      - 'channelaccess'
      - 'ca_server'
      - 'casrver'
  condition: selection
falsepositives:
  - Application crashes during development or debugging of IOC databases.
  - Resource exhaustion on constrained IOC hosts.
level: high
---
title: Suspicious Network Scanning for EPICS Channel Access Ports
id: 1f5e3a7c-9d4b-4e6f-a8c2-7b1d3e5f9a4c
status: experimental
description: Detects network scanning activity targeting EPICS Channel Access default ports (UDP/TCP 5064-5065), indicating reconnaissance for vulnerable EPICS Base deployments.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-300-01
  - https://attack.mitre.org/techniques/T1046/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.discovery
  - attack.t1046
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort:
      - 5064
      - 5065
  filter:
    Initiated: 'true'
  condition: selection and not filter
falsepositives:
  - Legitimate EPICS CA client tools (caget, caput, CSS/Phoebus OPIs) connecting to IOCs.
  - EPICS gateway and archiver appliances.
  - Tune by whitelisting known CA client subnets and excluding expected traffic patterns.
level: medium

// Hunt for inbound connections to EPICS Channel Access ports from external or unexpected sources
// Adjust KnownCASubnets to your authorized CA client ranges
let KnownCASubnets = dynamic(["10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16"]);
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DestinationPort in (5064, 5065)
| where not(ipv4_is_in_any_range(SourceIP, KnownCASubnets))
| summarize ConnectionCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
    by SourceIP, DestinationIP, DestinationPort, Protocol
| order by ConnectionCount desc;

// Hunt for EPICS IOC processes spawning unexpected child processes (via Syslog or CEF ingestion)
Syslog
| where TimeGenerated > ago(24h)
| where Facility =~ "user" or Facility =~ "daemon"
| where ProcessName has_any ("softIoc", "ioc", "st.cmd", "caget", "camonitor")
| where SyslogMessage has_any ("bash", "sh", "nc", "python", "perl", "wget", "curl", "core dumped", "segfault", "SIGSEGV", "SIGABRT")
| project TimeGenerated, Computer, ProcessName, SyslogMessage, HostIP
| order by TimeGenerated desc;

// Hunt for process crashes or segfaults on Linux IOC hosts (via Syslog/CEF)
Syslog
| where TimeGenerated > ago(24h)
| where SyslogMessage has_any ("segfault", "core dumped", "SIGSEGV", "stack smashing detected", "heap corruption", "double free", "malloc: corrupted")
| where SyslogMessage has_any ("ioc", "epics", "cas", "ca_server", "softIoc")
| project TimeGenerated, Computer, ProcessName, SyslogMessage
| order by TimeGenerated desc;

-- Hunt for EPICS IOC processes, their network connections, and any unexpected child processes
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime, ParentPid
FROM pslist()
WHERE CommandLine =~ '(softIoc|st\.cmd|iocBoot|camonitor|caget|ca_server)'
   OR Exe =~ '(epics|softIoc|ioc)'

-- Check for core dumps in common locations (adjust paths for your deployment)
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs=[
  '/var/crash/*',
  '/var/lib/systemd/coredump/*',
  '/tmp/core*',
  '/core*'
])
WHERE FullPath =~ '(core|crash)'
ORDER BY Ctime DESC

-- Check for suspicious network connections from EPICS-related processes
SELECT Pid, Name, RemoteAddr, RemotePort, LocalAddr, LocalPort, Status
FROM netstat()
WHERE Name =~ '(softIoc|ioc|epics)'
   AND RemotePort > 0
   AND NOT RemoteAddr =~ '^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.)'
ORDER BY Pid

#!/bin/bash
# EPICS Base CVE-2026-114595-598 Verification and Remediation Script
# Run as root or with sudo on EPICS IOC hosts
# Date: 2026-04-06

set -euo pipefail

echo "=== EPICS Base CVE-2026-114595-598 Remediation Script ==="
echo ""

# --- 1. Detect EPICS Base installation and version ---
echo "[1] Checking for EPICS Base installation..."

EPICS_BASE=""
if [ -n "${EPICS_BASE:-}" ] && [ -d "${EPICS_BASE}" ]; then
    echo "    EPICS_BASE env variable set to: ${EPICS_BASE}"
else
    # Common installation paths
    for dir in /opt/epics /usr/local/epics /epics ~/epics /opt/EPICS; do
        if [ -d "${dir}/base" ] || [ -f "${dir}/configure/CONFIG_BASE" ]; then
            EPICS_BASE="${dir}"
            echo "    Found EPICS installation at: ${EPICS_BASE}"
            break
        fi
    done
fi

if [ -z "${EPICS_BASE}" ]; then
    echo "    WARNING: No EPICS Base installation detected on this host."
    echo "    If EPICS is installed elsewhere, set EPICS_BASE and re-run."
else
    # Extract version
    VERSION_FILE="${EPICS_BASE}/configure/CONFIG_BASE"
    if [ -f "${VERSION_FILE}" ]; then
        EPICS_VER=$(grep -oP 'EPICS_VERSION\s*=\s*\K.*' "${VERSION_FILE}" 2>/dev/null || echo "unknown")
        EPICS_REV=$(grep -oP 'EPICS_REVISION\s*=\s*\K.*' "${VERSION_FILE}" 2>/dev/null || echo "unknown")
        EPICS_MOD=$(grep -oP 'EPICS_MODIFICATION\s*=\s*\K.*' "${VERSION_FILE}" 2>/dev/null || echo "unknown")
        echo "    EPICS Version: ${EPICS_VER}.${EPICS_REV}.${EPICS_MOD}"

        # Check if vulnerable (<= 7.0.10)
        if [ "${EPICS_VER}" -le 7 ] 2>/dev/null; then
            if [ "${EPICS_REV}" -eq 0 ] 2>/dev/null && [ "${EPICS_MOD}" -le 10 ] 2>/dev/null; then
                echo "    [!] VULNERABLE: EPICS Base ${EPICS_VER}.${EPICS_REV}.${EPICS_MOD} is <= 7.0.10"
                echo "    [!] ACTION REQUIRED: Upgrade to the latest patched EPICS Base release."
            elif [ "${EPICS_REV}" -gt 0 ] 2>/dev/null; then
                echo "    [OK] EPICS Base 7.1+ branch detected — verify against vendor advisory."
            fi
        else
            echo "    [OK] EPICS Base major version > 7 detected — verify against vendor advisory."
        fi
    fi
fi

echo ""

# --- 2. Check for running IOC processes ---
echo "[2] Checking for running EPICS IOC processes..."
IOC_PROCS=$(pgrep -af 'softIoc|st\.cmd|iocBoot' 2>/dev/null || true)
if [ -n "${IOC_PROCS}" ]; then
    echo "    Running IOC processes found:"
    echo "${IOC_PROCS}" | while read -r line; do echo "      $line"; done
else
    echo "    No EPICS IOC processes currently running."
fi

echo ""

# --- 3. Check network exposure of CA ports ---
echo "[3] Checking Channel Access port exposure (UDP/TCP 5064-5065)..."
if command -v ss &>/dev/null; then
    CA_LISTEN=$(ss -tulnp 2>/dev/null | grep -E ':(5064|5065)\b' || true)
    if [ -n "${CA_LISTEN}" ]; then
        echo "    CA protocol ports are LISTENING:"
        echo "${CA_LISTEN}" | while read -r line; do echo "      $line"; done
        echo ""
        echo "    [!] Ensure these ports are NOT exposed to untrusted networks."
        echo "    [!] Apply firewall rules to restrict CA access to authorized subnets only."
    else
        echo "    No CA ports currently listening."
    fi
fi

echo ""

# --- 4. Check for core dumps (potential exploitation artifacts) ---
echo "[4] Checking for recent core dumps..."
CORE_DIRS=("/var/crash" "/var/lib/systemd/coredump" "/tmp")
FOUND_CORES=false
for dir in "${CORE_DIRS[@]}"; do
    if [ -d "${dir}" ]; then
        CORES=$(find "${dir}" -maxdepth 1 -name 'core*' -mtime -7 2>/dev/null || true)
        if [ -n "${CORES}" ]; then
            echo "    Recent core dumps found in ${dir}:"
            echo "${CORES}" | while read -r line; do echo "      $line"; done
            FOUND_CORES=true
        fi
    fi
done
if [ "${FOUND_CORES}" = false ]; then
    echo "    No recent core dumps detected."
else
    echo "    [!] INVESTIGATE: Recent core dumps may indicate exploitation attempts."
fi

echo ""

# --- 5. Check dmesg for segfaults ---
echo "[5] Checking kernel logs for recent segfaults in EPICS processes..."
SEGFAULTS=$(dmesg -T 2>/dev/null | grep -i 'segfault' | grep -iE '(ioc|epics|softIoc|ca_)' | tail -5 || true)
if [ -n "${SEGFAULTS}" ]; then
    echo "    Segfaults detected:"
    echo "${SEGFAULTS}" | while read -r line; do echo "      $line"; done
    echo "    [!] INVESTIGATE: Segfaults in EPICS processes may indicate exploitation."
else
    echo "    No EPICS-related segfaults found in recent kernel logs."
fi

echo ""

# --- 6. Firewall hardening recommendations ---
echo "[6] Firewall hardening recommendations:"
echo "    Restrict CA protocol access using iptables/nftables:"
echo ""
echo "    # Allow CA only from authorized IOC/OPI subnets"
echo "    iptables -A INPUT -p udp --dport 5064 -s <AUTHORIZED_SUBNET> -j ACCEPT"
echo "    iptables -A INPUT -p udp --dport 5065 -s <AUTHORIZED_SUBNET> -j ACCEPT"
echo "    iptables -A INPUT -p tcp --dport 5064 -s <AUTHORIZED_SUBNET> -j ACCEPT"
echo "    iptables -A INPUT -p tcp --dport 5065 -s <AUTHORIZED_SUBNET> -j ACCEPT"
echo "    iptables -A INPUT -p udp --dport 5064 -j DROP"
echo "    iptables -A INPUT -p udp --dport 5065 -j DROP"
echo "    iptables -A INPUT -p tcp --dport 5064 -j DROP"
echo "    iptables -A INPUT -p tcp --dport 5065 -j DROP"

echo ""

echo "=== Remediation Summary ==="
echo "  1. UPGRADE EPICS Base to the latest patched release (see vendor advisory)."
echo "  2. RESTRICT network access to CA ports (5064/5065) to authorized subnets only."
echo "  3. MONITOR for IOC crashes, core dumps, and unexpected network connections."
echo "  4. REVIEW IOC console logs for signs of malformed CA messages."
echo "  5. SEGMENT ICS networks from IT networks per IEC 62443 / NIST SP 800-82."
echo ""
echo "Vendor Advisory: https://www.cisa.gov/news-events/ics-advisories/icsa-26-300-01"