CVE-2026-100730

Summary

A critical deserialization vulnerability in openPDC and openHistorian allows remote code execution through a service console interface that accepts client-supplied data structures. The flaw can be exploited by unauthenticated attackers on systems without Windows Authentication, or by authenticated attackers on systems with Windows Authentication.

Exploitability

Exploitation is relatively straightforward as it requires only sending a maliciously crafted serialized object to the vulnerable service console interface, with no additional preconditions needed beyond network access to the affected services.

Blast radius

The vulnerability could lead to complete system compromise with the privileges of the affected service account, potentially allowing attackers to execute arbitrary code across the entire industrial control system infrastructure.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to openPDC version 2.590 or later and openHistorian version 2.590 or later to remediate this deserialization vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.