openPDC CVE-2026-104629

Exploitation requires two concrete prerequisites stated in the description: (1) an authenticated user account on the openPDC/openHistorian instance (matching CVSS PR:L), and (2) the ability to place a file on the host filesystem (matching CVSS AT:P). The vulnerable mechanism is the component-loading feature, which constructs and runs any specified type (CWE-470 unsafe reflection) without validating that the type is a legitimate component, so the attacker's constructor code executes with the service account's privileges. Limiting factors that reduce realistic risk: the attacker cannot be fully unauthenticated, must already have (or obtain) filesystem write access on the host, and the resulting code runs only at the privilege level of the affected service account rather than automatically as system/root.

This is a genuine but conditional risk rather than a drop-everything emergency. The input CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H) scores 7.7 (High) and the AT:P (attack requirements present) metric correctly captures the real-world precondition stated in the description: the attacker must already hold an authenticated account AND be able to place a file on the host filesystem. PR:L confirms authentication is required, so this is not a remote-unauthenticated RCE despite the network attack vector. No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so exploitation probability signals are entirely absent; per precision rules this is 'no public exploit identified at time of analysis.' The high VC/VI/VA (full code execution as the service account via CWE-470 unsafe reflection) means impact is severe once the preconditions are met, but the dual requirement of an authenticated account plus filesystem write access materially reduces the realistic attacker population to insiders or already-partially-compromised environments. The network attack vector (AV:N) is somewhat in tension with the description's emphasis on local filesystem file placement - AV:N is defensible because the component-loading request itself can be triggered over the network by an authenticated user, but defenders should note the filesystem-write dependency, which behaves more like a local/adjacent precondition. Net: a real patch-soon priority for electric-sector ICS operators, not a wormable internet-facing crisis.

An authenticated low-privilege user of an openPDC or openHistorian deployment places a malicious assembly or file on the host filesystem, then uses the component-loading mechanism to specify that arbitrary type for instantiation. When the service constructs the specified type, the attacker's constructor code runs with the privileges of the affected service account, yielding code execution on the ICS host. No public exploit code was identified in the provided data.