Quick answers
- Is CVE-2026-101022 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-101022 being exploited in the wild.
- How severe is CVE-2026-101022?
- Medium severity, with a CVSS score of 4.3, published 9 October 2026.
- Which products and versions are affected?
- Grid Protection Alliance openHistorian <2.8.585; Grid Protection Alliance openPDC <2.9.482.
- Is there a fix for CVE-2026-101022?
- Yes: fixed in openPDC 2.9.482 and later; openHistorian 2.8.585 and later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-101022 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-101022?
- Check whether you run Grid Protection Alliance openHistorian or Grid Protection Alliance openPDC at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: openPDC 2.9.482 and later; openHistorian 2.8.585 and later
Technical details
The Modbus connection feature in openPDC fails to restrict destination addresses and ports, allowing authenticated users to trigger Server-Side Request Forgery (SSRF) attacks. By repeatedly attempting connections to different internal network destinations, an attacker can infer which hosts are reachable and map the internal network topology. The vulnerability requires prior authentication on systems using Windows Authentication, but may be reachable without authentication on other configurations.
Affected products
- Grid Protection Alliance openPDC <2.9.482
- Grid Protection Alliance openHistorian <2.8.585
Timeline
- 2026-10-08: advisory
- 2026-10-09: disclosed