What’s Vulnerable › Vulnerabilities

CVE-2026-85479: Grid Protection Alliance openPDC and openHistorian Missing Authentication for Critical Function

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-09 · updated 2026-10-11
• Weakness: CWE-306

Description

The STTP-based data publisher on openPDC accepts network connections without authentication in its default configuration. An unauthenticated network attacker can connect to this interface and exchange data with it.

Affected products

• Grid Protection Alliance openHistorian: before 2.8.580; before 2.8.585 — fixed in 2.8.580, 2.8.585
• Grid Protection Alliance openPDC: before 2.9.477; before 2.9.482 — fixed in 2.9.477, 2.9.482
• Grid Protection Alliance openPDC (Docker image): before 2.9.477; before 2.9.482 — fixed in 2.9.477, 2.9.482

How to fix

Upgrade to a fixed version: Grid Protection Alliance openHistorian 2.8.580, 2.8.585; Grid Protection Alliance openPDC 2.9.477, 2.9.482; Grid Protection Alliance openPDC (Docker image) 2.9.477, 2.9.482. Check the vendor advisory for mitigations.

References

• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-281-02.json
• https://www.cisa.gov/news-events/ics-advisories/icsa-26-281-02

Get alerted when CVE-2026-85479 or the next vulnerability affects your stack