CISA warns of critical flaws in openPDC and openHistorian software

The Cybersecurity and Infrastructure Security Agency released an alert on October 8, 2026, regarding critical security vulnerabilities in Grid Protection Alliance openPDC and openHistorian software. The affected products include versions of openPDC and openHistorian prior to version 2.9.477 and version 2.9.482, including openPDC Docker images. CISA assigned five common vulnerabilities and exposures identifiers to the issues, including CVE-2026-104629, CVE-2026-100730, CVE-2026-105281, CVE-2026-85479, and CVE-2026-101022. [1]

According to CISA Alerts, a service console interface within openPDC and openHistorian deserializes a client-supplied data structure. This flaw enables an attacker to trigger the deserialization of an arbitrary object graph. Successful exploitation could allow a remote user to achieve arbitrary code execution under the privileges of the affected service account. [1]

CISA Alerts noted that access requirements depend on system configuration. On systems that use Windows Authentication, an attacker must already be authenticated to reach the vulnerable function. Conversely, on systems without Windows Authentication enabled, an unauthenticated network attacker can access the interface. [1]