GPA Patches Critical Unauth RCE in openPDC, openHistorian Before 2.9.477, 2.8.580
A critical deserialization flaw allows remote code execution in grid monitoring tools, with unauthenticated access possible on some configurations.
Key points
- CVE-2026-100730 is rated CVSS 9.8 Critical by the National Vulnerability Database.
- The flaw affects openPDC versions before 2.9.477 and 2.9.482, and openHistorian before 2.8.580 and 2.8.585.
- Attackers can execute remote code under the service account privileges if they reach the console interface.
Grid Protection Alliance software used for power system monitoring contains a critical vulnerability that could allow attackers to take control of affected systems. The flaw, identified as CVE-2026-100730, exists in the service console interfaces of both openPDC and openHistorian. According to the National Vulnerability Database, the issue stems from how these applications handle data structures supplied by clients.
The vulnerability allows for remote code execution, meaning an attacker can run arbitrary commands on the host machine. The severity depends heavily on the authentication configuration of the deployment. On systems configured to use Windows Authentication, an attacker must already be authenticated to exploit the flaw. However, on systems that do not enforce Windows Authentication, the vulnerable function is reachable by an unauthenticated network attacker, significantly widening the attack surface.
In plain English
The core issue is unsafe deserialization. When openPDC or openHistorian receives data from a client, it attempts to convert that data back into an object structure. The software fails to properly validate this incoming data. An attacker can craft a malicious data structure that, when processed, forces the application to create arbitrary objects. This process can be manipulated to execute code on the server.
The impact is severe because the executed code runs with the privileges of the service account that hosts the application. If that account has high-level permissions, an attacker could potentially move laterally within the network, steal data, or disrupt grid monitoring operations. The distinction between authenticated and unauthenticated access is crucial for risk assessment; environments without Windows Authentication are exposed to anyone with network access to the service.
The background
openPDC and openHistorian are widely used tools in the energy sector for collecting and storing phasor measurement unit data. These tools are critical for maintaining the stability and security of electrical grids. Because they often operate in industrial control environments, they may be configured with reduced authentication requirements for ease of integration, which inadvertently exposes them to this specific risk. The National Vulnerability Database classifies the weakness under CWE-502, which refers to the deserialization of untrusted data.
What changes now
Organizations using these tools must verify their current versions against the affected ranges. The vulnerability affects openPDC versions prior to 2.9.477 and 2.9.482, including Docker images. For openHistorian, versions before 2.8.580 and 2.8.585 are vulnerable. While the source material identifies the vulnerable versions, it does not explicitly confirm the release of patched versions, though the versioning implies updates exist. Users should check with the vendor for confirmed fixes.
What to do and how to stay safe: Grid Protection Alliance
- Inventory all instances of openPDC and openHistorian to identify versions prior to 2.9.477/2.9.482 and 2.8.580/2.8.585.
- Verify authentication settings; ensure Windows Authentication is enabled where possible to restrict access to authenticated users only.
- Implement network segmentation to limit access to the service console interfaces from untrusted networks.
- Monitor logs for unusual deserialization errors or unexpected command executions on affected hosts.
Step-by-step guide: Automatic Updates Mistakes That Leave Systems Exposed
General security guidance from the RedTeam Monitor newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-100730?
The National Vulnerability Database rates the vulnerability as CVSS 9.8, which is considered Critical.
Does this vulnerability require authentication to exploit?
It depends on the configuration; systems with Windows Authentication require an attacker to be authenticated, while those without it allow unauthenticated access.
Which specific versions of openPDC are affected?
openPDC versions before 2.9.477 and before 2.9.482, including their Docker images, are affected.
