Six Critical Vulnerabilities Discovered in Grid Protection Alliance openPDC and openHistorian

The Cybersecurity and Infrastructure Security Agency (CISA) published Industrial Control Systems Advisory ICSA-26-281-02 on October 8, 2026, warning of six critical vulnerabilities in Grid Protection Alliance (GPA) openPDC and openHistorian. These energy-sector software platforms are used for real-time data acquisition, phasor measurement, and grid monitoring worldwide.

The most severe flaw, CVE-2026-100730, involves the deserialization of untrusted data in a service console interface. On systems without Windows Authentication, an unauthenticated network attacker can trigger deserialization of an arbitrary object graph, potentially leading to remote code execution under the service account privileges. On systems using Windows Authentication, the attacker must already be authenticated to reach the function. CVSS v3.1 scores of 9.8 classify this as critical.

CVE-2026-105281 affects the internal data publisher on openPDC, which by default accepts network connections without authentication. An unauthenticated network attacker can connect to retrieve the complete device and measurement topology of the system. GPA has updated the default configuration to bind this interface to the local loopback address only for new installations; however, existing installations upgraded from earlier versions retain their prior configuration and must have their interface binding manually verified and updated.

The remaining vulnerabilities include CVE-2026-104629, CVE-2026-85479, and CVE-2026-101022, which involve missing authentication for critical functions, server-side request forgery, and use of externally-controlled input to select classes or code ('unsafe reflection'), respectively. CVE-2026-105278, found in the Docker image variants, also involves deserialization of untrusted data.

GPA has released mitigations in openPDC version 2.9.482 and later and openHistorian version 2.8.585 and later, which include added validation into the serialization logic. For Docker image users, GPA does not recommend production use of published images, as the fix has not been published to the Docker images.

Given the widespread deployment of these tools in the Energy Critical Infrastructure sector and the potential for remote code execution and full system topology disclosure, the advisory urges operators to update to the patched versions immediately and review network exposure of the affected interfaces.