Grid Protection Alliance openPDC and openHistorian

CISA has published ICS advisory ICSA-26-281-02 detailing six vulnerabilities affecting Grid Protection Alliance's openPDC and openHistorian products used in the energy sector. The most critical vulnerability (CVE-2026-100730, CVSS 9.8) involves deserialization of untrusted data enabling remote code execution. CVE-2026-105278 (CVSS 9.8) affects the Docker image with hard-coded administrative credentials allowing full application takeover. CVE-2026-104629 (CVSS 8.8) enables unsafe reflection allowing authenticated attackers to run arbitrary constructor code. Two missing authentication vulnerabilities (CVE-2026-105281 and CVE-2026-85479) expose internal data publisher and STTP-based data publisher interfaces to unauthenticated network attackers. CVE-2026-101022 is an SSRF vulnerability in the Modbus connection feature allowing internal network mapping. Fixes are available in openPDC 2.9.477/2.9.482 and openHistorian 2.8.580/2.8.585, though Docker images have no fix planned. These vulnerabilities were reported by Shubham Raj of Causal Security.