CISA ICSA-26-281-02: Patch openPDC and openHistorian OT Data Systems
Tech GuruQuick Answer
The authority published ICSA-26-281-02 for Grid Protection Alliance openPDC and openHistorian, including published openPDC Docker images. CISA reports unsafe deserialization, missing authentication, server-side request forgery, hard-coded credentials, and unsafe reflection that can lead to administrative control, code execution, operational-data access, or internal-network mapping. Affected deployments should be matched to the authority's exact scope and moved to the supported fixed release.
Patch The OT Product And Verify Network Isolation
What to do now: Inventory Grid Protection Alliance openPDC and openHistorian, including published openPDC Docker images, match the exact affected release, apply the authority-supported update and mitigations, validate process and network behavior in a controlled window, and retain change and monitoring evidence.
Last verified: 2026-10-10 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Grid Protection Alliance openPDC and openHistorian, including published openPDC Docker images |
|---|---|
| Advisory | ICSA-26-281-02 |
| CVEs | CVE-2026-100730, CVE-2026-101022, CVE-2026-104629, CVE-2026-105278, CVE-2026-105281, CVE-2026-85479 |
| Authoritative release date | 2026-10-08 06:00:00 UTC in CISA's authoritative CSAF record |
| Authority revision date | 2026-10-08 06:00:00 UTC; initial CISA advisory |
| Affected versions | openPDC releases before the applicable 2.9.477 and 2.9.482 fixes, openHistorian releases before the applicable 2.8.580 and 2.8.585 fixes, and published openPDC Docker images identified by CISA. |
| Fixed version | openPDC 2.9.482 or later and openHistorian 2.8.585 or later, plus explicit interface-binding and Modbus firewall validation; CISA states that no fixed published openPDC Docker image is planned |
| CVSS base score | 4.3 / 5.3 / 7.5 / 8.8 / 9.8 (CVSS v3.1) |
| CVSS severity | Medium to Critical |
| Exploitation status | CISA is not aware of public exploitation specifically targeting these vulnerabilities as of the advisory release; no exploitation claim is inferred. |
What Changed
CISA reports unsafe deserialization, missing authentication, server-side request forgery, hard-coded credentials, and unsafe reflection that can lead to administrative control, code execution, operational-data access, or internal-network mapping.
What To Validate Now
- Inventory. Locate Grid Protection Alliance openPDC and openHistorian, including published openPDC Docker images, exact releases, architectures or image types, owners, network zones, remote-access paths, dependencies, and recovery procedures.
- Establish applicability. Compare each deployment with CISA's affected-version statement: openPDC releases before the applicable 2.9.477 and 2.9.482 fixes, openHistorian releases before the applicable 2.8.580 and 2.8.585 fixes, and published openPDC Docker images identified by CISA. Do not infer applicability from vendor or product-family presence alone.
- Remediate. Apply openPDC 2.9.482 or later and openHistorian 2.8.585 or later, plus explicit interface-binding and Modbus firewall validation; CISA states that no fixed published openPDC Docker image is planned and the network-exposure controls in the current CISA advisory after an OT impact and risk assessment.
- Validate. Confirm the resulting version and configuration, exercise representative process, administration, network, logging, redundancy, and recovery paths, and monitor for regressions.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Do not treat a version update alone as proof that upgraded installations use loopback-only bindings; CISA says prior configurations can persist. Grid Protection Alliance does not recommend published Docker images for production and has not published the fixes to that image path. Coordinate changes with OT data owners and preserve configuration, image, firewall, and validation evidence.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
