Grid Protection Alliance openPDC & openHistorian Vulnerabilities: CVE-2026-100730 and Related Issues

What happened

Grid Protection Alliance released several critical flaws in its openPDC and openHistorian products. The issues include deserialization of untrusted data, missing authentication for critical functions, server‑side request forgery, hard‑coded credentials, and unsafe reflection. The vulnerabilities are identified as CVE‑2026‑100730, CVE‑2026‑104629, CVE‑2026‑105281, CVE‑2026‑85479, CVE‑2026‑101022, and CVE‑2026‑105278.

Impact

Severity: CVSS v3 9.8 (critical)

• Versions <2.9.482 of openPDC and <2.8.585 of openHistorian are affected.
• Unauthenticated network attackers can trigger remote code execution on systems without Windows Authentication.
• Authenticated attackers can exploit the service console to execute arbitrary code under the service account.

What to do

• Upgrade openPDC to 2.9.482 or later and openHistorian to 2.8.585 or later.
• Verify that Windows Authentication is enabled or restrict network access to the service console.
• Remove or change any hard‑coded credentials and review configuration files for exposed secrets.
• Apply any vendor‑issued patches that add input validation to serialization logic.

Remediation status

Grid Protection Alliance has released fixes that add validation to serialization logic and address the other listed vulnerabilities. Deploy the latest versions as soon as possible.