Grid Protection Alliance openPDC and openHistorian
CISA warns openPDC and openHistorian have critical flaws, including unauthenticated remote code execution.
CISA published ICSA-26-281-02 for Grid Protection Alliance openPDC and openHistorian, energy-sector tools deployed worldwide. CVE-2026-100730 is a deserialization flaw scored CVSS 9.8 that can allow unauthenticated remote code execution when Windows Authentication is not used. CVE-2026-105281 leaves the internal data publisher unauthenticated by default, exposing device and measurement topology. Vendor fixes are in openPDC 2.9.482 and openHistorian 2.8.585; published Docker images are not fixed and are not recommended for production.
- Unauthenticated deserialization can yield remote code execution without Windows Authentication.
- The default data publisher lacks authentication and exposes device and measurement topology.
- Fixes are in openPDC 2.9.482 and openHistorian 2.8.585; Docker images stay unfixed.
- Upgrades retain old bindings, so operators must confirm interfaces are not exposed.
- Vendors
- Grid Protection Alliance
- Products
- openPDCopenHistorian
- Organizations
- CISAGrid Protection Alliance
- Countries
- United States
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-100730 | Unsafe deserialization RCE in openPDC and openHistorian | 9.3 group max | — |
From the original article
11 min read at cisa.govView CSAF Summary The following versions of Grid Protection Alliance openPDC and openHistorian are affected: openPDC <2. 9. 477, <2.
By CISA · cisa.gov
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.