CVE-2026-100730: Grid Protection Alliance openPDC and openHistorian Deserialization of Untrusted Data
CVE-2026-100730 is a critical deserialization of untrusted data flaw (CWE-502) in a service console interface of Grid Protection Alliance openPDC and openHistorian. The record reports CVSS 3.1 9.8 and CVSS 4.0 9.3, and it describes possible remote code execution under the service account privileges. The sources consulted do not show confirmed exploitation, and the record lists no fixed versions, so operators should check the vendor and CISA guidance.
Overview
The record describes a deserialization of untrusted data weakness (CWE-502) in a service console interface used by Grid Protection Alliance openPDC and openHistorian. The console deserializes a data structure supplied by the client, so the application may reconstruct an object graph that the operator did not intend to accept.
Impact
- The record states that the flaw could allow remote code execution under the privileges of the affected service account.
- Where Windows Authentication is used, the attacker must already be authenticated to reach the affected function.
- Where Windows Authentication is not used, the record states that an unauthenticated network attacker can reach the function.
- The CVSS 3.1 vector in the record is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, with a base score of 9.8. The record also lists a CVSS 4.0 score of 9.3 from the same CNA.
Affected products and versions
The record lists the following ranges:
- Grid Protection Alliance openHistorian: less than 2.8.580 and less than 2.8.585.
- Grid Protection Alliance openPDC: less than 2.9.477 and less than 2.9.482.
- Grid Protection Alliance openPDC (Docker image): less than 2.9.477 and less than 2.9.482.
The record does not list fixed versions. The upper bounds of these ranges suggest that later builds may not be affected, but this is an inference and should be confirmed with the vendor or the CISA ICS advisory ICSA-26-281-02.
Exploitation status
- The record shows the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
- The SSVC data in the record lists exploitation as none and automatable as yes.
- No confirmed exploitation appears in the sources consulted for this analysis.
- The EPSS probability is 0.00625 (percentile 0.48576), dated 2026-10-13.
Remediation and mitigation
- Identify all openPDC and openHistorian installations, including Docker-based deployments, and compare their versions with the ranges listed above.
- Follow the vendor guidance and the CISA advisory to update affected installations to a build outside the listed ranges.
- Until updates are applied, restrict network access to the service console to trusted management networks and use network segmentation for industrial control environments.
- Where the product supports it, use Windows Authentication and review who holds access to the authenticated functions.
- Run the services with the least privileges needed, so that a compromise has a limited effect.
Detection guidance
- Review network logs for unexpected connections to the service console ports from untrusted hosts.
- Monitor the affected service accounts for unusual process creation, file writes or authentication events.
- Alert on unexpected restarts or crashes of the openPDC and openHistorian services, which may indicate abnormal input handling.
Limitations of the available information
- The record does not identify the fixed versions, so the safe build must be confirmed with the vendor.
- The exact network ports and console paths are not stated in the record.
- The record does not describe any proof of concept or observed attack activity.
- The CVSS 4.0 and 3.1 scores are taken from the record and were not independently verified.
Frequently asked questions
What is the weakness in CVE-2026-100730?
The record describes deserialization of untrusted data (CWE-502) in a service console interface, which may allow the reconstruction of an unintended object graph.
Is CVE-2026-100730 known to be exploited?
The record shows it is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted for this analysis.
Which versions are listed as affected?
The record lists openHistorian before 2.8.580 and before 2.8.585, and openPDC including its Docker image before 2.9.477 and before 2.9.482.
What should operators do now?
Inventory installations, follow the vendor and CISA guidance to update, restrict console network access, and apply least privilege to service accounts.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.