CISA has issued an ICS advisory for Grid Protection Alliance’s openPDC and openHistorian, software used worldwide in the energy sector. The five-plus vulnerabilities include Use of Hard-coded Credentials, Missing Authentication for Critical Function, insecure deserialization of untrusted data, SSRF, and unsafe reflection. The highest-rated issue carries a CVSS v3 score of 9.8.
From an identity and access perspective, the hard-coded credentials and missing authentication weaknesses are the most notable: they can allow attackers to bypass access controls and reach critical functions without valid authentication. The deserialization flaw (CVE-2026-100730) is partly mitigated on systems using Windows Authentication, where an attacker must already be authenticated, but is far more exposed on systems lacking that protection.
What to take away: organizations running affected openPDC (including the Docker image) and openHistorian versions should upgrade to the patched builds and review their authentication configuration—relying on Windows Authentication meaningfully reduces the attack surface for several of these issues.