Critical RCE vulnerability found in Grid Protection Alliance openPDC and openHistorian

A critical remote code execution vulnerability has been identified in the openPDC and openHistorian software platforms developed by the Grid Protection Alliance. The flaw, tracked as CVE-2026-100730, allows attackers to execute arbitrary code on affected systems by exploiting unsafe deserialization in the service console interface.

The vulnerability carries a CVSS base score of 9.8, placing it in the Critical severity range. According to the National Vulnerability Database (NVD), the issue stems from the way the service console interface handles client-supplied data structures. When the system processes this input, it deserializes the data without sufficient validation, enabling an attacker to trigger the deserialization of an arbitrary object graph. This process can lead to remote code execution, granting the attacker control under the privileges of the service account running the application.

Authentication Requirements and Attack Surface

The exploitability of CVE-2026-100730 depends heavily on the authentication configuration of the deployed system. On installations configured to use Windows Authentication, an attacker must already possess valid credentials to reach the vulnerable function. This requirement limits the immediate attack surface to scenarios where credential theft or brute-force attacks have already succeeded.

However, the risk is significantly higher for systems that do not enforce Windows Authentication. In these configurations, the vulnerable interface is reachable by unauthenticated network attackers. This means an adversary with network access to the service console can exploit the flaw without needing prior credentials, making these deployments prime targets for remote compromise.

Affected Software Versions

The Grid Protection Alliance has identified specific version ranges for both openPDC and openHistorian that contain this vulnerability. For openPDC, the flaw affects all versions prior to 2.9.477 and those prior to 2.9.482. This includes both standard installations and the Docker image versions of the software.

The openHistorian platform is also affected, with vulnerabilities present in versions before 2.8.580 and before 2.8.585. Organizations using any version within these ranges are exposed to the risk of remote code execution via the service console interface.

What should you do?

Security teams should immediately audit their environments to determine if openPDC or openHistorian is deployed and identify the current version numbers. If the software is running, administrators should review the authentication settings to ensure Windows Authentication is enabled, thereby restricting access to authenticated users only. Network segmentation should be enforced to limit access to the service console interface, ensuring that only trusted management stations can reach the port.