CVE-2026-100730

openPDC and openHistorian expose a service console that deserializes a data structure supplied by the client (CWE-502). On systems that do not use Windows Authentication, an unauthenticated network attacker can reach this function; when Windows Authentication is enabled, the attacker must already be authenticated. Successful deserialization of an arbitrary object graph can lead to remote code execution as the affected service account, with high impact on confidentiality, integrity, and availability of that host (CVSS 4.0 9.3). The products are Grid Protection Alliance tools used for power-system phasor and historian data, so operators of those deployments are the affected population. CISA has not listed the CVE in the KEV catalog, and no public proof-of-concept is known.

What to do: Treat the service console as untrusted until Grid Protection Alliance publishes a fix, and apply that update as soon as it is available. Where Windows Authentication is off, enable it so the interface is not reachable by anonymous network clients, and restrict the console to trusted management networks. Run the service under a least-privilege account and review logs for unexpected console connections.