CVE-2026-100730: Grid Protection Alliance openPDC RCE (pending)

CVE-2026-100730 is a deserialization-of-untrusted-data flaw in Grid Protection Alliance's openPDC and openHistorian: a service console deserializes client-supplied data, reachable without authentication on systems that don't use Windows Authentication, allowing remote code execution under the service account's privileges; NVD has not yet completed its own CVSS scoring or CPE mapping, so this page stays noindex until that analysis is published.

CVE-2026-100730 is a deserialization of untrusted data vulnerability (CWE-502) in Grid Protection Alliance's openPDC and openHistorian, two widely used open-source platforms for phasor data concentration and time-series historian functions in electric grid monitoring. NVD's description states: "A service console interface on openPDC and openHistorian deserializes a client-supplied data structure. On systems using Windows Authentication, an attacker must already be authenticated to reach this function; on systems without Windows Authentication, this is reachable by an unauthenticated network attacker. This allows an attacker to trigger deserialization of an arbitrary object graph, which could allow remote code execution under the privileges of the affected service account" (NVD).

NVD tracks the CVE with status "Awaiting Analysis" as of 2026-10-27: it records a CNA-submitted (ICS-CERT) CVSS v3.1 score of 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, and a CVSS v4.0 score of 9.3 (critical), but NVD has not published its own independent score or a CPE applicability statement, so this page leaves cvss_score unset rather than presenting the CNA figure as NVD-confirmed (NVD).

CISA's advisory ICSA-26-281-02, published 2026-10-08, confirms openPDC before 2.9.482 and openHistorian before 2.8.585 are affected and fixed in those versions (with network binding to loopback only recommended as an additional mitigation). The same advisory discloses five related flaws in the same products: CVE-2026-105281 (unauthenticated internal data publisher, 7.5), CVE-2026-85479 (unauthenticated STTP publisher, 5.3), CVE-2026-101022 (Modbus unrestricted destination addresses, 4.3), CVE-2026-105278 (fixed Docker administrative credentials, 9.8) and CVE-2026-104629 (arbitrary type construction via component loader, 8.8) — and it notes Grid Protection Alliance does not recommend production use of the published Docker images (CISA ICS Advisory ICSA-26-281-02).

This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of 2026-10-27, and FIRST scores the probability of exploitation at 0.00625 (49.688th percentile) as of 2026-10-26 (CISA KEV, FIRST EPSS).

Because NVD has not finished its own severity and applicability analysis, this page does not yet meet the minimum data bar for indexing and will be revisited once that analysis is published. In the meantime, openPDC and openHistorian operators should update to the fixed versions, bind service console interfaces to local loopback only, and avoid running the vendor's Docker images in production given the additional hardcoded-credential flaw disclosed in the same advisory.

• A service console in openPDC/openHistorian deserializes client-supplied data; unauthenticated on systems without Windows Authentication, allowing remote code execution under the service account (CWE-502). — NVD
• NVD status is "Awaiting Analysis" with a CNA (ICS-CERT) submitted CVSS v3.1 9.8 / v4.0 9.3, no NVD-published score or CPE configuration as of 2026-10-27. — NVD
• Affects openPDC before 2.9.482 and openHistorian before 2.8.585, fixed in those versions; disclosed alongside five related CVEs (CVE-2026-105281, -85479, -101022, -105278, -104629) in the same ICSA-26-281-02 advisory; Docker images not recommended for production. — CISA ICS Advisory ICSA-26-281-02
• Not present in the CISA KEV catalog as of 2026-10-27. — CISA KEV
• EPSS score is 0.00625 (49.688th percentile) as of 2026-10-26. — FIRST EPSS