Grid Protection Alliance openPDC/openHistorian: Deserialization of untrusted data in service console
Summary
A service console interface in openPDC and openHistorian deserializes client-supplied data without sufficient validation. On systems without Windows Authentication, an unauthenticated network attacker can trigger deserialization of an arbitrary object graph, which could lead to remote code execution under the privileges of the affected service account. On systems with Windows Authentication, the attacker must first be authenticated.
Affected
- openPDC before 2.9.482 (CISA also lists versions before 2.9.477 as affected)
- openPDC Docker image before 2.9.482
- openHistorian before 2.8.585 (CISA also lists versions before 2.8.580 as affected)
Fixed in
- openPDC 2.9.482 or later
- openHistorian 2.8.585 or later
- openPDC Docker image: Unknown. CISA lists it as affected; the vendor states the fix has not been published to the Docker image.
Workaround
- No vendor-published workaround for this CVE is known.
- Enabling Windows Authentication limits the unauthenticated attack path, but does not remove the flaw.
- Restrict network access to the service console to trusted hosts only.
Exploitation
- No known public exploitation at publication (CISA SSVC: Exploitation none; automatable: yes; technical impact: total).
- No public proof of concept found.
- EPSS 0.00625 per Vulners (low estimate, to be rechecked).
Our recommendation
- Check whether any openPDC or openHistorian instance, including Docker containers, is in use.
- Upgrade to openPDC 2.9.482 or openHistorian 2.8.585 or later, and apply the upgrade together with the other CVEs in ICSA-26-281-02.
- Do not use the Docker image in production until the vendor publishes a fix.
- Remove internet and business network exposure of the service console and restrict access via firewall and secure VPN.
- Monitor the service console for unusual connections and check for an upgrade that retains old network bindings.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CISA ICS Advisory ICSA-26-281-02 www.cisa.gov
- CISA CSAF file ICSA-26-281-02 github.com
- Vulners CVE data and EPSS vulners.com
- Vulners CVE record CVELIST:CVE-2026-100730 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 02:45.
Original description (NVD)
A service console interface on openPDC and openHistorian deserializes a client-supplied data structure. On systems using Windows Authentication, an attacker must already be authenticated to reach this function; on systems without Windows Authentication, this is reachable by an unauthenticated network attacker. This allows an attacker to trigger deserialization of an arbitrary object graph, which could allow remote code execution under the privileges of the affected service account.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.