The US Cybersecurity and Infrastructure Security Agency (CISA) has published an ICS advisory on six vulnerabilities in HMS Networks' PEAK-System PCAN Windows CAN drivers used for fieldbus communication. Successful exploitation could crash the Windows kernel, turning a test bench, maintenance workstation or other CAN-connected host into a kernel-availability risk.

What is affected

Affected versions are Device Driver Setup through 5.1.2.1151 and PCAN Windows CAN device drivers through 5.1.2. The CVEs are CVE-2026-109576, CVE-2026-101103, CVE-2026-94188, CVE-2026-103672, CVE-2026-110322 and CVE-2026-105960; CISA's CSAF lists five at CVSS 3.1 5.5 (medium) and one at 7.1 (high). HMS addressed the issues in version 5.1.4 and recommends upgrading to the newest available version. CISA says the flaws are not remotely exploitable and that no known public exploitation targeting them had been reported to CISA at publication.

What to do

CISA lists transportation, healthcare, energy and critical manufacturing sectors and says deployment is worldwide. Asset and version discovery should come first, followed by a vendor-supported upgrade coordinated with operational owners, testing compatibility and service impact before deployment. Network isolation remains an important layer, not a substitute for the driver fix: the agency advises limiting network exposure and isolating control systems behind firewalls.