{"id":"CVE-2026-100730","published":"2026-10-09T14:17:09.607","lastModified":"2026-10-11T17:16:56.753","description":"A service console interface on openPDC and openHistorian deserializes a client-supplied data structure. On systems using Windows Authentication, an attacker must already be authenticated to reach this function; on systems without Windows Authentication, this is reachable by an unauthenticated network attacker. This allows an attacker to trigger deserialization of an arbitrary object graph, which could allow remote code execution under the privileges of the affected service account.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-502"],"vendors":[],"products":[],"references":[{"url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-281-02.json","tags":[]},{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-281-02","tags":[]}],"exploitRefs":[{"url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-281-02.json","tags":[]}],"hasPoc":true,"ai":{"summary":"A critical deserialization vulnerability in openPDC and openHistorian allows remote code execution through a service console interface that accepts client-supplied data structures. The flaw can be exploited by unauthenticated attackers on systems without Windows Authentication, or by authenticated attackers on systems with Windows Authentication.","exploitability":"Exploitation is relatively straightforward as it requires only sending a maliciously crafted serialized object to the vulnerable service console interface, with no additional preconditions needed beyond network access to the affected services.","blast_radius":"The vulnerability could lead to complete system compromise with the privileges of the affected service account, potentially allowing attackers to execute arbitrary code across the entire industrial control system infrastructure.","remediation":"Upgrade to openPDC version 2.590 or later and openHistorian version 2.590 or later to remediate this deserialization vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","deserialization","ics"],"model":"garnet-coder","analyzedAt":"2026-10-12T08:43:31.427Z"}}