CISA ICSA-26-281-02: Grid Protection Alliance openPDC/openHistorian RCE/SSRF/Pre-Auth Vulnerabilities

Vulnerability Overview Vulnerability Name: Grid Protection Alliance openPDC and openHistorian Release Date: October 8, 2026 Alert Code: ICSA-26-281-02 Related Topics: Industrial Control System Vulnerabilities, Industrial Control Systems Scope of Impact Affected Versions: - openPDC <2.9.477, <2.9.482 - openPDC (Docker image) <2.9.477, <2.9.482 - openHistorian <2.8.580, <2.8.585 CVSS Score: v3 9.8 Vendor: Grid Protection Alliance Device: openPDC Vulnerability Details 1. CVE-2026-100730 - Description: The service console interface of openPDC and openHistorian deserializes client-provided data structures. If the system uses Windows authentication, the attacker must already be authenticated to access this feature; on systems without Windows authentication, an unauthenticated network attacker can access it. This allows the attacker to trigger the serialization of arbitrary object graphs, potentially leading to remote code execution. 2. CVE-2026-105281 - Description: The internal data publisher of openPDC accepts network connections from unauthenticated users in its default configuration. An unauthenticated network attacker can connect to this interface and retrieve the full topology of devices and measurements of the system. 3. CVE-2026-85479 - Description: The STTP data publisher of openPDC accepts network connections from unauthenticated users in its default configuration. An unauthenticated network attacker can connect to this interface and exchange data. 4. CVE-2026-101022 - Description: The Modbus connection feature of openPDC accepts caller-specified destination addresses and ports without restrictions on internal hosts. An authenticated user can attempt to connect to arbitrary internal network destinations, revealing which destinations are reachable. Through repeated attempts, an attacker may be able to map the internal network. 5. CVE-2026-105278 - Description: The published Docker image of openPDC contains a hardcoded administrative credential that does not force a change upon first use. An attacker with network access can use this credential and the management interface to authenticate and gain full administrative control of the application. 6. CVE-2026-104629 - Description: The component loading mechanism in openPDC and openHistorian builds and runs any specified type, including potentially invalid components. An attacker with an authenticated user account and file placement privileges can exploit this feature to run arbitrary constructor code with the privileges of the affected service account. Remediation Recommended Practices: - Minimize the network exposure of all control system devices and/or systems to ensure they are not accessible from the Internet. - Place control system networks and remote devices behind firewalls and isolate them from business networks. - When remote access is required, use more secure remote access methods such as Virtual Private Networks (VPNs), and regularly update to the latest versions. - Conduct appropriate impact analysis and risk assessment before deploying defenses. - Implement recommended cybersecurity strategies to proactively defend ICS assets. - Follow internal procedures to report suspicious malicious activity and track relatedness with CISA. - Take the following measures to protect yourself from social engineering attacks: - Do not click links in unsolicited emails or open attachments. - Refer to "Identifying and Avoiding Email Scams" for more information. - Refer to "Avoiding Social Engineering and Phishing Attacks" for more information. Additional Information Background: - Critical Infrastructure Sector: Energy - Deployed Countries/Regions: Global - Company Headquarters Location: United States Acknowledgments: - Shubham Raj (Cipher) of Causal Security reported these vulnerabilities to CISA. Legal Notice and Terms of Use: - This product is subject to this notice and the Privacy and Usage Policy. Revision History: - Initial Release Date: 2026-10-08 - Revision: 1 - Summary: Initial Release Tags Sector: Energy Sector Topics: Industrial Control System Vulnerabilities, Industrial Control Systems Related Advisories Satel Netco Design Red Lion Controls N-Tron 700 Series Hitachi Energy SOI Johnson Controls EasyIO FG Feedback Share your thoughts. We recently updated our anonymous product survey and welcome your feedback. --- Note: Specific POC code or exploit code was not included in the page.

Goal Reached Thanks to every supporter — we hit 100%!

CISA ICSA-26-281-02: Grid Protection Alliance openPDC/openHistorian RCE/SSRF/Pre-Auth Vulnerabilities

More from this source