CVE-2026-100730

{
  "etk_id": "ETK-2026-1104",
  "cve_id": "CVE-2026-100730",
  "display_id": "CVE-2026-100730",
  "ghsa_id": "GHSA-g2gc-jv32-q89f",
  "euvd_id": "EUVD-2026-95779",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unsafe deserialization in openPDC and openHistorian",
  "summary": "The service console interfaces in openPDC and openHistorian process client-supplied serialized data unsafely. An attacker may be able to execute code with the affected service account's privileges; Windows Authentication requires the attacker to be authenticated, while deployments without it may be reachable unauthenticated over the network.",
  "mitigation": "Upgrade openPDC, including its Docker image, to 2.9.477 or 2.9.482, and upgrade openHistorian to 2.8.580 or 2.8.585. Enable Windows Authentication where feasible to reduce unauthenticated exposure until upgrades are complete.",
  "vendor": "Grid Protection Alliance",
  "product": "openPDC",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 2.9.477",
        ">= 0, < 2.9.482"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "2.9.477",
        "2.9.482"
      ],
      "package_name": "openPDC",
      "purl": null
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 2.9.477",
        ">= 0, < 2.9.482"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "2.9.477",
        "2.9.482"
      ],
      "package_name": "openPDC (Docker image)",
      "purl": null
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 2.8.580",
        ">= 0, < 2.8.585"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "2.8.580",
        "2.8.585"
      ],
      "package_name": "openHistorian",
      "purl": null
    }
  ],
  "cwes": [
    502
  ],
  "cvss_score": 9.3,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
  "epss_score": 0.0063,
  "epss_percentile": 0.4904,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 40.8803529,
  "t0_at": "2026-10-09T13:44:39.190000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-09T13:44:39.190000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-09T13:44:39.190000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-100730"
    }
  }
}