CVSS 9.8: Unauthenticated RCE in openPDC/openHistorian via Unsafe Deserialization

The National Vulnerability Database has recorded a critical remote code execution flaw in the Grid Protection Alliance’s openPDC and openHistorian platforms. Identified as CVE-2026-100730, the vulnerability carries a CVSS score of 9.8, indicating a severe threat level for organizations deploying these energy sector tools.

The risk

The flaw stems from unsafe deserialization within the service console interface of both applications. According to the NVD record, the system deserializes data structures supplied by clients. This process allows an attacker to trigger the deserialization of an arbitrary object graph. If successful, this action enables remote code execution under the privileges of the affected service account.

The severity of the exploit depends on the authentication configuration. On systems configured without Windows Authentication, the vulnerable function is reachable by an unauthenticated network attacker. This means an adversary does not need valid credentials to initiate the attack. Conversely, on systems using Windows Authentication, an attacker must already be authenticated to reach the specific function. Even in this scenario, the ability to execute code as the service account represents a significant privilege escalation risk.

Who is exposed

Grid Protection Alliance openPDC users are affected if they are running versions prior to 2.9.477 or prior to 2.9.482. This includes both standard installations and Docker images of openPDC that fall below these version thresholds.

Users of openHistorian are similarly exposed if their installations are before version 2.8.580 or before version 2.8.585. Organizations managing energy grid data or monitoring systems using these specific legacy versions must verify their current deployment status immediately.

Cost and compliance

The source material does not report on financial costs, regulatory fines, or specific compliance impacts resulting from this vulnerability. The NVD record focuses solely on the technical mechanics and version scope of CVE-2026-100730.

What should you do?

Security teams should inventory all instances of openPDC and openHistorian to identify versions prior to the fixed releases. Network segmentation should be reviewed to ensure that unauthenticated users cannot reach the service console interfaces of these applications.

Background: Remote code execution vulnerabilities

Small businesses face high remote code execution risks due to limited patching resources and complex dependencies. You can mitigate this by enforcing strict input validation, maintaining an accurate IT asset inventory, and requiring vendors to demonstrate automated security regression testing for all updates.

Read the full guide: Remote Code Execution Risks and Protection for Small Businesses

What to do and how to stay safe: Grid Protection Alliance

• Audit network configurations to block unauthenticated access to openPDC and openHistorian service consoles.
• Verify current software versions against the affected lists provided by the vendor.
• Monitor server logs for unusual deserialization attempts or unauthorized code execution.
• Apply the latest vendor updates once they are confirmed to address CVE-2026-100730.

Step-by-step guide: Zero-Day Vulnerabilities Meaning: How Unpatched Flaws Bypass Your Defenses

General security guidance from the Vector Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-100730?

The vulnerability has a CVSS score of 9.8, which is rated as critical.

Which openPDC versions are vulnerable?

openPDC versions before 2.9.477 and before 2.9.482, including Docker images, are affected.

Is authentication required to exploit this flaw?

Authentication is not required if the system is not using Windows Authentication; otherwise, an attacker must already be authenticated.