CISA flags critical flaws in HMS Networks PCAN Windows drivers

The Cybersecurity and Infrastructure Security Agency (CISA) has added HMS Networks' PEAK-System PCAN Windows drivers to its list of known vulnerable products. The advisory identifies six CVEs - CVE-2026-109576, CVE-2026-101103, CVE-2026-94188, CVE-2026-103672, CVE-2026-110322, and CVE-2026-105960 - affecting PEAK-System Device Driver Setup versions ≤ 5.1.2.1151 and PCAN Windows CAN device drivers versions ≤ 5.1.2. The vulnerabilities are rated CVSS v3 7.1 and include out-of-bounds write, classic buffer overflow, improper validation of array index, untrusted pointer dereference, and length-parameter inconsistencies.

The advisory notes that successful exploitation could crash the Windows kernel, posing risks to critical infrastructure sectors such as transportation systems, healthcare and public health, energy, and critical manufacturing. The affected drivers are deployed worldwide and are produced by HMS Networks, a Sweden-based company.

HMS Networks AB has issued a mitigation: the issues are addressed in driver version 5.1.4. The company recommends that all users upgrade to the newest available version and obtain updates from the PEAK-System PCAN software download page. The advisory also references an HMS security advisory for additional guidance.

CISA's notice does not specify a comment period or further regulatory action, but it serves as a formal notification to federal agencies, contractors, and other entities that rely on the affected drivers. Organizations are advised to verify their driver versions and apply the 5.1.4 update promptly to mitigate the identified risks.