# HMS PEAK-System PCAN drivers crash Windows kernel

Published: 2026-10-20 · Severity: elevated · Sectors: Transportation, Healthcare, Energy, Manufacturing
Canonical: https://vorant.io/reports/6f0e6b03-75a0-5588-a7a8-6a628a03cac5/hms-peak-system-pcan-drivers-crash-windows-kernel

> Six local vulnerabilities in HMS Networks PEAK-System PCAN Windows drivers can crash the Windows kernel; no known public exploitation.

CISA published an ICS advisory for HMS Networks' PEAK-System PCAN Windows CAN device drivers, used in industrial and automotive CAN-bus communication across Transportation, Healthcare, Energy, and Critical Manufacturing sectors worldwide. Six vulnerabilities (CVE-2026-109576, CVE-2026-101103, CVE-2026-94188, CVE-2026-103672, CVE-2026-110322, CVE-2026-105960) affect PEAK-System Device Driver Setup versions 5.1.2.1151 and earlier, and PCAN Windows CAN device drivers version 5.1.2 and earlier. Successful exploitation could crash the Windows kernel, resulting in a denial-of-service condition on affected hosts.

CISA notes these vulnerabilities are not remotely exploitable and that no public exploitation has been reported. The vulnerabilities were responsibly disclosed to CISA by researcher Seyeon Bang. Defenders should apply vendor-recommended updates when available, minimize network exposure of control system devices, isolate ICS networks behind firewalls, and use secure remote access methods such as VPNs where necessary. Given the local-only attack vector and absence of in-the-wild exploitation, this represents a routine ICS patch advisory requiring standard asset inventory and patch management rather than emergency response.

## Mentioned in this report

- Vulnerabilities: CVE-2026-101103, CVE-2026-103672, CVE-2026-105960, CVE-2026-109576, CVE-2026-110322, CVE-2026-94188

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-293-01

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/6f0e6b03-75a0-5588-a7a8-6a628a03cac5/hms-peak-system-pcan-drivers-crash-windows-kernel.
In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup