CISA 2026-10-08

Grid Protection Alliance openPDC and openHistorian

Machine-generated analysis · WAYSCloud LLM

openPDC versions earlier than 2.9.482 and openHistorian versions earlier than 2.8.585 are listed as vulnerable. The advisory notes remote code execution is possible via deserialization of untrusted data.

Context

The advisory concerns Grid Protection Alliance’s openPDC and openHistorian software. It reports multiple high-severity vulnerabilities, including deserialization of untrusted data that can lead to remote code execution, especially when Windows Authentication is not enforced. The vendor has released fixes that add validation to the serialization logic in the mentioned later versions.

Operator considerations

Check: inventory the openPDC and openHistorian versions deployed.
Isolate: restrict network access to the service console interface until patched.
Patch: upgrade openPDC to 2.9.482 or newer and openHistorian to 2.8.585 or newer.
Log: monitor for unexpected service-console requests and authentication attempts.

From Cybersecurity and Infrastructure Security Agency ↗

The following versions of Grid Protection Alliance openPDC and openHistorian are affected:

openPDC

Read the full advisory on CISA →