CVE-2026-100730: CWE-502 in Grid Protection Alliance openPDC

The vulnerability CVE-2026-100730 in Grid Protection Alliance openPDC and openHistorian arises from unsafe deserialization of client-supplied data structures in a service console interface. This flaw allows an attacker to trigger deserialization of arbitrary object graphs, potentially leading to remote code execution under the service account's privileges. The attack surface differs based on authentication configuration: unauthenticated network attackers can reach the vulnerable function if Windows Authentication is disabled; otherwise, attackers must be authenticated. The CVSS 3.1 base score is 9.8, reflecting critical impact with network attack vector, low attack complexity, no privileges required (in some configurations), no user interaction, and high confidentiality, integrity, and availability impacts.

Exploitation of this vulnerability can lead to remote code execution on affected systems with the privileges of the service account running openPDC or openHistorian. This can result in full compromise of the affected system, including unauthorized access, data manipulation, and service disruption. The severity is critical as indicated by the CVSS score of 9.8.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the service console interface, especially on systems without Windows Authentication, to trusted users only. Monitor for unusual activity and consider disabling or isolating the vulnerable interface if possible.