EUVD-2026-95779
GHSA-g2gc-jv32-q89f
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach service console interface over network
-
ExploitSubmit crafted serialized object graph
-
ExecutionTrigger unsafe deserialization (CWE-502)
-
ImpactExecute arbitrary code as service account
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The attacker must be able to reach the service console interface of openPDC or openHistorian over the network and send a serialized object to the function that deserializes client-supplied data. The decisive limiting factor is the authentication mode: on deployments WITHOUT Windows Authentication the path is reachable by an unauthenticated network attacker (worst case, matching PR:N); on deployments WITH Windows Authentication enabled the attacker must already hold valid authenticated access before reaching the vulnerable function. No user interaction is required. Impact is bounded by the privileges of the service account running openPDC/openHistorian, so running the service as a low-privileged, non-administrative account limits post-exploitation reach. Enabling Windows Authentication and restricting network exposure of the console interface are the primary mitigating configurations. |
| Impact | This is a genuine high-priority vulnerability, not a high-CVSS-but-low-risk artifact. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity flaw requiring no privileges, no user interaction, and no special attack requirements, yielding full confidentiality, integrity, and availability impact (VC:H/VI:H/VA:H) - consistent with CWE-502 unsafe deserialization leading to RCE and the 9.3 score. A critical nuance: the PR:N rating reflects only the worst case. Per the description, the unauthenticated path exists ONLY on systems NOT using Windows Authentication; where Windows Authentication is enabled the attacker must already be authenticated, effectively PR:L. The vector therefore represents the least-hardened deployment, and defenders should determine their own authentication posture before treating this as fully pre-auth. EPSS is not provided, so exploitation probability cannot be quantified. The CVE is NOT listed in CISA KEV and no public POC is indicated, so there is no public exploit identified at time of analysis - the signals point to a serious but not-yet-weaponized issue. The ICS-CERT reporting origin and electric-grid product context raise the strategic/targeted-attack concern even though the raw deployment footprint is small. |
| Exploit ScenarioDerived | An attacker with network access to the openPDC/openHistorian service console interface submits a crafted serialized object graph to the function that deserializes client-supplied data. On a deployment not using Windows Authentication this requires no credentials; the resulting unsafe deserialization executes arbitrary code under the service account's privileges. No public exploit is identified at time of analysis, though CWE-502 flaws of this type are typically straightforward to weaponize once the serialization format is known. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 09, 2026
Insecure deserialization in the service console interface of openPDC and openHistorian lets an attacker submit a crafted serialized object graph to a function that deserializes client-supplied data, potentially achieving remote code execution under the privileges of the affected service account. Grid Protection Alliance's openPDC, its Docker image, and openHistorian are all affected, with CPE data indicating no version restriction (all releases). Whether the flaw is remotely exploitable without credentials depends entirely on configuration: deployments without Windows Authentication are reachable by an unauthenticated network attacker (the CVSS 4.0 vector carries PR:N), while deployments with Windows Authentication require the attacker to already hold valid authenticated access. No public exploit code or confirmed in-the-wild exploitation has been identified at time of analysis, but the assessed CVSS:3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity, and availability impact) and the absence of user interaction make this a genuine high-priority issue for exposed, unauthenticated console interfaces in OT environments.
Earlier versions of this analysis (1)
Deserialization of a client-supplied object graph on the Grid Protection Alliance openPDC, openPDC Docker image and openHistorian service console interface can let an attacker run code with the privileges of the affected service account. Exposure is deployment-dependent: instances configured WITHOUT Windows Authentication expose the vulnerable endpoint to an unauthenticated network attacker (consistent with the assessed CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N, base 9.8), while instances that enforce Windows Authentication require the attacker to already hold valid credentials to reach the function. No public exploit code has been identified at time of analysis, and the CVE does not appear in CISA KEV; the practical risk is concentrated on installations that expose the service console to untrusted networks without Windows Authentication enabled, with containerized deployments of the Docker image a particular concern.
RemediationAI
No vendor-released patch or fixed version is identified at time of analysis; remediation therefore depends on configuration hardening until an update is published by Grid Protection Alliance. The highest-value control is to enable Windows Authentication on the service console, which converts the pre-authentication path into an authenticated one and removes the unauthenticated attack surface described in the advisory. In parallel, restrict network exposure of the console interface with host and network firewall rules so that only trusted engineering workstations and management subnets can reach the console port - the trade-off is that remote administration must be performed from approved jump hosts rather than from arbitrary clients. Follow ICS network segmentation guidance so openPDC/openHistorian hosts cannot be reached directly from IT or internet-facing networks and cannot be used as a pivot into the OT environment. Run the openPDC and openHistorian services (and their Docker containers) under a dedicated low-privilege, non-administrative account; this does not prevent the deserialization bug from firing but confines post-exploitation code execution to that account's rights and blocks privilege escalation pathways. Monitor the CISA advisory page (https://www.cisa.gov/news-events/ics-advisories/icsa-26-281-02) and the vendor's distribution channels for a patched release, and stage it promptly once available.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 3 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-502, Deserialization of Untrusted Data. openPDC and openHistorian are .NET-based grid-protection and time-series historian applications, and their service console exposes an interface that accepts a structured, serialized payload from a client and reconstructs it into live objects. Because the deserialization routine does not constrain the types it will instantiate, an attacker can supply an arbitrary object graph that triggers gadget-chain execution inside the service process. The critical architectural detail is that this endpoint is not inherently gated: on installations where Windows Authentication is not enabled, the console interface is reachable directly over the network by an unauthenticated party, matching the PR:N vector; on installations that do enable Windows Authentication, the same code path sits behind an authentication barrier and requires a pre-authenticated foothold. Impact is bounded by the identity under which the service runs, so a service account with administrative rights on the host or domain turns a deserialization bug into a full compromise. Grid Protection Alliance packages the software both as a conventional Windows application and as a Docker image, and the wildcard CPE entries (cpe:2.3:a:grid_protection_alliance:openpdc:*, openpdc_(docker_image), openhistorian) indicate the vendor's advisory does not carve out version ranges, so all deployments should be treated as affected.
Know when Openpdc gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Network-reachable deserialization with no privileges on non-Windows-Auth deployments (PR:N worst case) and low complexity yields full C/I/A via code execution; scope unchanged as code runs within the service account.
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
Lifecycle Timeline
3DescriptionCVE.org
A service console interface on openPDC and openHistorian deserializes a client-supplied data structure. On systems using Windows Authentication, an attacker must already be authenticated to reach this function; on systems without Windows Authentication, this is reachable by an unauthenticated network attacker. This allows an attacker to trigger deserialization of an arbitrary object graph, which could allow remote code execution under the privileges of the affected service account.
Executive ViewAI
openPDC, the openPDC Docker image, and openHistorian-software used for grid protection and operational monitoring-are affected by a critical vulnerability that could allow an attacker to execute code under the service account, potentially disrupting critical infrastructure operations. All releases appear impacted, and no vendor-released patch identified at time of analysis, though no public exploit identified at time of analysis. Leadership should prioritize reducing exposure and strengthening authentication controls because these systems often support sensitive operational technology environments.
No vendor-released patch identified at time of analysis. Interim mitigations include enforcing Windows Authentication, network segmentation and isolation of openPDC, openPDC Docker image, and openHistorian instances, restricting service console access to trusted networks, applying least privilege to the affected service account, enabling enhanced logging and monitoring for suspicious deserialization activity, and disabling or restricting the vulnerable service console interface if operationally feasible.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Unauthenticated access to the openPDC internal data publisher lets any host that can reach the service connect and subsc
Unauthenticated access to the STTP-based data publisher in Grid Protection Alliance openPDC, the openPDC Docker image, a
Arbitrary constructor code execution in Grid Protection Alliance openPDC and openHistorian is reachable by an authentica
An authenticated low-privilege user of openPDC can abuse the Modbus connection feature to make outbound connections to a
Exploit-DB