# CVE-2026-100730: Grid Protection Alliance openPDC and openHistorian unsafe deserialization

Source: https://junglewise.ai/threats/cve-2026-100730-a-service-console-interface-on-openpdc-and-openhistorian  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-09. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-100730 · Severity: critical · CVSS 9.8 · Published 2026-10-09

openPDC and openHistorian are industrial control systems that monitor and manage electrical grid data. A service console interface in these products deserializes untrusted data without proper validation, allowing attackers to execute arbitrary code with the privileges of the service account. On Windows Authentication-enabled systems, the attacker must be authenticated first; on systems without Windows Authentication, the vulnerability is reachable without any credentials.

Technologies: [Grid Protection Alliance openHistorian](https://junglewise.ai/threats/technologies/openhistorian), [Grid Protection Alliance openPDC](https://junglewise.ai/threats/technologies/openpdc), [Grid Protection Alliance openPDC (Docker image)](https://junglewise.ai/threats/technologies/openpdc-docker-image). Vendors: [Grid Protection Alliance](https://junglewise.ai/threats/vendors/grid-protection-alliance).

## Quick answers

**Is CVE-2026-100730 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-100730 being exploited in the wild.

**How severe is CVE-2026-100730?** Critical severity, with a CVSS score of 9.8, published 9 October 2026.

**Which products and versions are affected?** Grid Protection Alliance openHistorian <2.8.585; Grid Protection Alliance openPDC <2.9.482; Grid Protection Alliance openPDC (Docker image) <2.9.482.

**Is there a fix for CVE-2026-100730?** Yes: fixed in openPDC 2.9.482 and later; openHistorian 2.8.585 and later. Until then: On systems without Windows Authentication, restrict network access to the service console interface. Systems using Windows Authentication are additionally protected as they require prior authentication to reach this function. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-100730 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-100730?** Check whether you run Grid Protection Alliance openHistorian, Grid Protection Alliance openPDC or Grid Protection Alliance openPDC (Docker image) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in openPDC 2.9.482 and later; openHistorian 2.8.585 and later

On systems without Windows Authentication, restrict network access to the service console interface. Systems using Windows Authentication are additionally protected as they require prior authentication to reach this function.

## Technical details

The service console interface in openPDC and openHistorian performs unsafe deserialization of client-supplied data structures (CWE-502), allowing remote code execution. On Windows Authentication systems, authentication is required to reach the function; on non-authenticated systems, the attack is reachable over the network without credentials. The vulnerability was fixed by adding additional validation to the serialization logic in openPDC 2.9.482+ and openHistorian 2.8.585+.

## Affected products

- Grid Protection Alliance openPDC <2.9.482
- Grid Protection Alliance openPDC (Docker image) <2.9.482
- Grid Protection Alliance openHistorian <2.8.585

## Timeline

- 2026-10-08: disclosed
- 2026-10-08: advisory

## References

- [https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-281-02.json](https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-281-02.json)
- [https://www.cisa.gov/news-events/ics-advisories/icsa-26-281-02](https://www.cisa.gov/news-events/ics-advisories/icsa-26-281-02)

## Related threats

- [Grid Protection Alliance openPDC Docker hardcoded credential](https://junglewise.ai/threats/cve-2026-105278-the-published-docker-image-for-openpdc-includes-a-fixed)
- [openPDC STTP data publisher missing authentication](https://junglewise.ai/threats/cve-2026-85479-the-sttp-based-data-publisher-on-openpdc-accepts-network)
- [Grid Protection Alliance openPDC data publisher missing authentication](https://junglewise.ai/threats/cve-2026-105281-the-internal-data-publisher-on-openpdc-accepts-network)
- [Grid Protection Alliance openPDC and openHistorian deserialization and authentication vulnerabilities](https://junglewise.ai/threats/cve-2026-104629-grid-protection-alliance-openpdc-and-openhistorian)
- [Grid Protection Alliance openPDC Modbus SSRF network reconnaissance](https://junglewise.ai/threats/cve-2026-101022-a-modbus-connection-feature-on-openpdc-accepts-a-caller)