Six Kernel-Crash CVEs in HMS Networks PCAN Windows Drivers: What ICS Operators Must Do Now
Executive Summary
In October 2026, CISA published ICS Advisory ICSA-26-293-01 disclosing six memory-safety vulnerabilities in HMS Networks PEAK-System PCAN Windows drivers (versions ≤5.1.2 / ≤5.1.2.1151). The flaws—spanning out-of-bounds writes, classic buffer overflows, improper array-index validation, untrusted pointer dereference, and length-parameter inconsistency—allow a local, low-privileged user to crash the Windows kernel, causing denial-of-service conditions on workstations and engineering stations running CAN-bus hardware. Affected sectors include Transportation, Healthcare, Energy, and Critical Manufacturing globally. HMS Networks released a fix in version 5.1.4 and recommends immediate upgrade.
Kernel-level driver vulnerabilities in OT/ICS environments are an accelerating trend: attackers increasingly target device drivers as a reliable path to system instability or privilege escalation on engineering workstations that are difficult to patch quickly. With six CVEs simultaneously disclosed across widely deployed industrial CAN-bus drivers, organizations should treat driver patch management as a first-class control within their ICS security programs.
Why This Matters Now
Industrial device-driver security is rapidly becoming a front-line OT risk. These six kernel-crash vulnerabilities exist in drivers deployed across Transportation, Healthcare, Energy, and Critical Manufacturing worldwide. Because engineering workstations running PCAN drivers often operate in air-gapped or change-controlled environments, patching lags can be significant—leaving systems exposed to insider threats or supply-chain attackers who can trigger availability-destroying Blue Screens of Death with minimal privilege.
Attack Path Analysis
An attacker with local access to an ICS/OT workstation running vulnerable HMS Networks PEAK-System PCAN Windows drivers (versions <=5.1.2) exploits one or more kernel-level memory corruption vulnerabilities (out-of-bounds write, buffer overflow, improper array index validation, untrusted pointer dereference, length parameter mishandling) to crash the Windows kernel, potentially enabling privilege escalation to SYSTEM context. Once elevated, the attacker can pivot laterally across OT network segments to other CAN-bus-connected control system assets, establish persistence or covert command channels, and ultimately disrupt or destroy ICS processes critical to transportation, healthcare, energy, or manufacturing operations.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
An attacker with low-privileged local access to an ICS/OT engineering workstation or HMI running PEAK-System PCAN Windows drivers <=5.1.2 initiates exploitation by sending malformed IOCTL requests or crafted CAN bus records to the vulnerable kernel-mode driver. The attack vector is local (AV:L), requires low privileges (PR:L), and no user interaction (UI:N), consistent with all six disclosed CVEs. The attacker may have gained initial foothold via phishing, supply chain compromise of the driver installer, or physical/remote access to an inadequately segmented OT workstation.
Related CVEs
CVE-2026-109576
CVSS 5.5The parser in PEAK-System PCAN driver correctly detected malformed records but advanced its processed-bytes counter even when a record was rejected as invalid, leading to an out-of-bounds write condition that can crash the Windows kernel.
Affected Products:
HMS Networks PEAK-System Device Driver Setup – <=5.1.2.1151
HMS Networks PCAN Windows CAN device drivers – <=5.1.2
Exploit Status:
no public exploitCVE-2026-101103
CVSS 5.5The PEAK-System PCAN diagnostic call did not validate that the caller-supplied output buffer was large enough to hold the output record, resulting in a classic buffer overflow (CWE-120) that can crash the Windows kernel.
Affected Products:
HMS Networks PEAK-System Device Driver Setup – <=5.1.2.1151
HMS Networks PCAN Windows CAN device drivers – <=5.1.2
Exploit Status:
no public exploitCVE-2026-94188
CVSS 5.5The copied source field in PEAK-System PCAN is attacker-influenced through the file-device write path; an attacker can combine a small output allocation with controlled source bytes to trigger a buffer overflow (CWE-120) and crash the Windows kernel.
Affected Products:
HMS Networks PEAK-System Device Driver Setup – <=5.1.2.1151
HMS Networks PCAN Windows CAN device drivers – <=5.1.2
Exploit Status:
no public exploitCVE-2026-103672
CVSS 7.1The PEAK-System PCAN parser indexes a length table using an attacker-controlled DLC value without enforcing DLC <= 0x0f, then copies attacker payload from record+0x1c into a fixed-size stack destination, allowing improper array index validation (CWE-129) leading to integrity and availability impact.
Affected Products:
HMS Networks PEAK-System Device Driver Setup – <=5.1.2.1151
HMS Networks PCAN Windows CAN device drivers – <=5.1.2
Exploit Status:
no public exploitCVE-2026-110322
CVSS 5.5The PEAK-System PCAN type 0x4030 processing path fails to validate a selected or returned object pointer before dereferencing fixed fields during post-processing, resulting in an untrusted pointer dereference (CWE-822) that can crash the Windows kernel.
Affected Products:
HMS Networks PEAK-System Device Driver Setup – <=5.1.2.1151
HMS Networks PCAN Windows CAN device drivers – <=5.1.2
Exploit Status:
no public exploitCVE-2026-105960
CVSS 5.5PEAK-System PCAN contains a vulnerable variable-length receive-record copy operation where the driver uses a requested or queued record count without sufficiently capping the copy to the actual caller-supplied output length, causing improper handling of length parameter inconsistency (CWE-130) and potential Windows kernel crash.
Affected Products:
HMS Networks PEAK-System Device Driver Setup – <=5.1.2.1151
HMS Networks PCAN Windows CAN device drivers – <=5.1.2
Exploit Status:
no public exploit
MITRE ATT&CK® Techniques
Exploitation for Client Execution
Exploitation for Privilege Escalation
Endpoint Denial of Service
Supply Chain Compromise
Exploitation for Defense Evasion
Command and Scripting Interpreter
Exploit Public-Facing Application
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
NIST SP 800-53 Rev 5 – Flaw Remediation
Control ID: SI-2
NIS2 Directive – Vulnerability Handling and Disclosure
Control ID: Article 21(2)(e)
CISA Zero Trust Maturity Model 2.0 – Device Health and Vulnerability Management
Control ID: Device Pillar - Device Visibility and Compliance
IEC 62443 (ISA/IEC) – Software and Information Integrity / Input Validation
Control ID: SR 2.4 / SR 3.5
DORA (Digital Operational Resilience Act) – ICT Risk Management and Patch Governance
Control ID: Article 9 - ICT Security
HIPAA Security Rule – Protection from Malicious Software
Control ID: 45 CFR § 164.308(a)(5)(ii)(B)
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Transportation
PCAN Windows driver vulnerabilities (CVE-2026-103672, CVSS 7.1) in CAN bus interfaces threaten transportation ICS/OT systems, risking kernel crashes that disrupt vehicle network communications and safety-critical control operations.
Industrial Automation
HMS Networks PCAN driver flaws expose industrial automation OT environments to Windows kernel crashes via buffer overflows and untrusted pointer dereferences, threatening continuity of CAN-bus-dependent manufacturing control systems.
Health Care / Life Sciences
CISA-designated critical infrastructure sector faces ICS/OT driver vulnerabilities in PCAN-connected medical devices; kernel crashes from CWE-787 and CWE-822 flaws risk availability of life-critical diagnostic and operational equipment.
Oil/Energy/Solar/Greentech
Energy sector ICS deployments using HMS Networks PCAN CAN device drivers risk operational disruption; kernel-level availability impacts from six unpatched CVEs threaten SCADA and distributed control system stability worldwide.
Sources
- HMS Networks PEAK-System PCAN Windows drivershttps://www.cisa.gov/news-events/ics-advisories/icsa-26-293-01Verified
- HMS Networks Security Advisory - PEAK-System PCAN Driver Vulnerabilitieshttps://www.hms-networks.com/security-advisoriesVerified
- PEAK-System PCAN Software Download Page - Version 5.1.4 Updatehttps://www.peak-system.com/Software.68.0.htmlVerified
- CISA ICS Cybersecurity Recommended Practiceshttps://www.cisa.gov/icsVerified
- CISA Known Exploited Vulnerabilities Cataloghttps://www.cisa.gov/known-exploited-vulnerabilities-catalogVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF is relevant here because the attack chain depends heavily on lateral reachability across flat OT network segments after a local kernel-level compromise of an ICS engineering workstation. By enforcing microsegmentation and identity-aware east-west controls, CNSF would likely reduce the attacker's ability to pivot from a single compromised host to broader ICS infrastructure, meaningfully shrinking the blast radius of this exploit chain.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: CNSF fabric-level visibility and workload-aware network segmentation would likely reduce the attacker's ability to reach the vulnerable OT workstation from lateral network positions, constraining the initial reachability paths available to an adversary moving from IT-adjacent zones or poorly isolated OT segments toward the target host.
Control: Zero Trust Segmentation
Mitigation: Zero Trust segmentation would likely constrain the post-escalation impact scope by ensuring that even a host operating under SYSTEM-level compromise cannot automatically reach adjacent OT workloads, SCADA servers, or PLC segments without passing through enforced policy boundaries, reducing how much of the environment a fully compromised workstation can access.
Control: East-West Traffic Security
Mitigation: East-west traffic enforcement would likely constrain the attacker's lateral movement paths by restricting which OT segments, SCADA servers, and engineering workstations the compromised host may reach, reducing the ability to pivot freely across control system assets even after achieving SYSTEM privileges on the initial workstation.
Control: Multicloud Visibility & Control
Mitigation: Centralized multicloud visibility and traffic observability across OT network segments would likely surface anomalous outbound communication patterns from the compromised workstation, reducing the attacker's ability to maintain covert command and control channels without generating detectable traffic anomalies that enforcement policy could act upon.
Control: Egress Security & Policy Enforcement
Mitigation: Egress security controls and FQDN-based policy enforcement would likely constrain the attacker's ability to transfer sensitive OT configuration data or CAN bus logs to arbitrary external destinations, reducing the reachability of outbound paths from compromised ICS workstations to attacker-controlled infrastructure.
Even where prior-stage controls have reduced attacker reachability and lateral movement scope, a locally executed kernel crash on the compromised workstation itself would remain a residual risk, though the blast radius to adjacent OT assets and critical ICS processes would likely be meaningfully narrower given constrained east-west paths and segmented zone boundaries established earlier in the kill chain.
Impact at a Glance
Affected Business Functions
- Industrial Control System (ICS) Driver Operations
- CAN Bus Communication and Device Management
- Windows Kernel Stability in OT/ICS Environments
- Critical Infrastructure Operational Technology Availability
Estimated downtime: 1 days
Estimated loss: N/A
No confidential data exfiltration is indicated. The primary risk is availability: successful exploitation by a local low-privileged attacker can crash the Windows kernel (Blue Screen of Death), disrupting CAN bus communications and industrial control operations in Transportation, Healthcare, Energy, and Critical Manufacturing sectors. Systems relying on PCAN drivers for real-time CAN network access could face unexpected downtime until the driver is patched or the system rebooted. No sensitive data records, PII, or proprietary operational data are confirmed as exposed; the impact is denial-of-service at the kernel level.
Recommended Actions
Key Takeaways & Next Steps
- • Immediately upgrade all HMS Networks PEAK-System PCAN Windows driver installations to version 5.1.4 or later, and apply zero-trust segmentation (microsegmentation, identity-based policy, namespace enforcement) to isolate OT engineering workstations from CAN-bus-connected control assets and IT networks, preventing lateral movement exploitation of SYSTEM-level compromise.
- • Deploy east-west traffic security controls between OT workload segments to detect and block unauthorized workload-to-workload communication paths that an attacker with escalated kernel privileges could exploit for lateral movement across ICS environments.
- • Enforce egress security and policy enforcement (FQDN filtering, outbound traffic controls, data loss prevention) on all OT workstations to prevent exfiltration of sensitive CAN bus logs, PLC configurations, or engineering files to unauthorized external destinations following kernel-level compromise.
- • Implement multicloud visibility and control with centralized traffic observability and anomaly detection across hybrid OT/IT environments to identify suspicious IOCTL patterns, repeated malformed CAN bus requests, or covert outbound communication channels indicative of post-exploitation activity.
- • Apply inline IPS (Suricata-based) inspection on network paths accessible from OT workstations to detect known exploit traffic patterns and malicious payload delivery associated with CVE-2026-103672, CVE-2026-110322, and related kernel driver exploitation signatures, complemented by Cloud Native Security Fabric (CNSF) inline enforcement for real-time inspection of control plane interactions.
