HMS PEAK-System PCAN drivers crash Windows kernel
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
Six local vulnerabilities in HMS Networks PEAK-System PCAN Windows drivers can crash the Windows kernel; no known public exploitation.
CISA published an ICS advisory for HMS Networks' PEAK-System PCAN Windows CAN device drivers, used in industrial and automotive CAN-bus communication across Transportation, Healthcare, Energy, and Critical Manufacturing sectors worldwide. Six vulnerabilities (CVE-2026-109576, CVE-2026-101103, CVE-2026-94188, CVE-2026-103672, CVE-2026-110322, CVE-2026-105960) affect PEAK-System Device Driver Setup versions 5.1.2.1151 and earlier, and PCAN Windows CAN device drivers version 5.1.2 and earlier. Successful exploitation could crash the Windows kernel, resulting in a denial-of-service condition on affected hosts.
CISA notes these vulnerabilities are not remotely exploitable and that no public exploitation has been reported. The vulnerabilities were responsibly disclosed to CISA by researcher Seyeon Bang. Defenders should apply vendor-recommended updates when available, minimize network exposure of control system devices, isolate ICS networks behind firewalls, and use secure remote access methods such as VPNs where necessary. Given the local-only attack vector and absence of in-the-wild exploitation, this represents a routine ICS patch advisory requiring standard asset inventory and patch management rather than emergency response.
Mentioned in this report
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-293-01
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 13,704 reports from 144 sources, 519 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs