Is CVE-2026-85479 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-85479 being exploited in the wild.

How severe is CVE-2026-85479?

Medium severity, with a CVSS score of 5.3, published 9 October 2026.

Which products and versions are affected?

Grid Protection Alliance openHistorian <2.8.585; Grid Protection Alliance openPDC <2.9.482.

How is CVE-2026-85479 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-85479?

Check whether you run Grid Protection Alliance openHistorian or Grid Protection Alliance openPDC at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-85479: openPDC STTP data publisher missing authentication

Q: Is there a fix for CVE-2026-85479?

Yes: fixed in openPDC 2.9.482 and later; openHistorian 2.8.585 and later. Until then: Verify and update the interface binding configuration to restrict the data publisher to the local loopback address only. Note that existing installations upgraded from earlier versions retain their prior configuration and do not receive the new default automatically. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-85479 attacked?

It is attacked over the network, in a hosted service.

Q: Am I affected by CVE-2026-85479?

Check whether you run Grid Protection Alliance openHistorian or Grid Protection Alliance openPDC at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-85479 · Severity: medium · CVSS 5.3 · Published 2026-10-09

openPDC is a data management platform used in power grid and energy infrastructure. The STTP-based data publisher component in the default configuration accepts network connections without requiring authentication, allowing an attacker to connect remotely and exchange data. This could enable an attacker to access or modify critical energy system data.

Technologies: Grid Protection Alliance openHistorian, Grid Protection Alliance openPDC. Vendors: Grid Protection Alliance.

Quick answers

Is CVE-2026-85479 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-85479 being exploited in the wild.
How severe is CVE-2026-85479?: Medium severity, with a CVSS score of 5.3, published 9 October 2026.
Which products and versions are affected?: Grid Protection Alliance openHistorian <2.8.585; Grid Protection Alliance openPDC <2.9.482.
Is there a fix for CVE-2026-85479?: Yes: fixed in openPDC 2.9.482 and later; openHistorian 2.8.585 and later. Until then: Verify and update the interface binding configuration to restrict the data publisher to the local loopback address only. Note that existing installations upgraded from earlier versions retain their prior configuration and do not receive the new default automatically. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-85479 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-85479?: Check whether you run Grid Protection Alliance openHistorian or Grid Protection Alliance openPDC at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: openPDC 2.9.482 and later; openHistorian 2.8.585 and later

Verify and update the interface binding configuration to restrict the data publisher to the local loopback address only. Note that existing installations upgraded from earlier versions retain their prior configuration and do not receive the new default automatically.

Technical details

The STTP-based data publisher on openPDC lacks authentication in its default configuration, making it accessible over the network to unauthenticated attackers. The vulnerability is reachable via network attack vector with no authentication required and no user interaction needed. An attacker can connect to the interface and exchange data with the publisher.

Affected products

Grid Protection Alliance openPDC <2.9.482
Grid Protection Alliance openHistorian <2.8.585

Timeline

2026-10-08: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.