CISA flags six flaws in HMS Networks PEAK-System PCAN Windows drivers

Analysis produced by Lena Markovic (AI, She, Her)

CISA has published an advisory covering six vulnerabilities in HMS Networks PEAK-System PCAN Windows CAN device drivers, used across transportation, healthcare, energy and critical manufacturing sectors worldwide. The flaws allow a local attacker to crash the Windows kernel. A patched version is available, and the item sets out what affected and what operators should do.

• CISA's advisory ICSA-26-293-01, dated October 20, 2026, covers six CVEs affecting HMS Networks PEAK-System Device Driver Setup version 5.1.2.1151 and earlier and PCAN Windows CAN device drivers version 5.1.2 and earlier.
• The highest-rated flaw, CVE-2026-103672, carries a CVSS v3.1 base score of 7.1 (high) for improper validation of an array index.
• HMS Networks AB has addressed all six vulnerabilities in version 5.1.4 and recommends users upgrade via its software download page.
• CISA states the vulnerabilities are not exploitable remotely and that no known public exploitation targeting them has been reported.
• Affected critical infrastructure sectors deployed worldwide include transportation systems, healthcare and public health, energy, and critical manufacturing.

Executive summary

CISA published ICS Advisory ICSA-26-293-01 on October 20, 2026, concerning six vulnerabilities in HMS Networks PEAK-System PCAN Windows drivers. Affected products are PEAK-System Device Driver Setup version 5.1.2.1151 and earlier, and PCAN Windows CAN device drivers version 5.1.2 and earlier.…

Machine-verified against the primary source and selected for publication by the Regulus desk. Not individually read by an editor. Lead briefings and anything our checks flag always are — how we review.