{"id":"CVE-2026-104629","published":"2026-10-09T14:17:11.027","lastModified":"2026-10-09T17:16:45.117","description":"A component loading mechanism in openPDC and openHistorian will construct and run any specified type, which may be an invalid component to load. An attacker with an authenticated user account and the ability to place a file on the host filesystem can use this to run arbitrary constructor code, and this code runs with the privileges of the affected service account.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-470"],"vendors":[],"products":[],"references":[{"url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-281-02.json","tags":[]},{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-281-02","tags":[]}],"exploitRefs":[{"url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-281-02.json","tags":[]}],"hasPoc":true,"ai":{"summary":"A component loading mechanism in openPDC and openHistorian allows authenticated attackers to execute arbitrary constructor code by loading invalid components, running with the privileges of the service account. This creates a high-impact privilege escalation vulnerability.","exploitability":"Exploitation requires an authenticated user account and filesystem write access to place malicious files, making it moderately difficult but achievable in environments where users can upload or modify files on the host system.","blast_radius":"If exploited, this vulnerability could allow attackers to execute arbitrary code as the service account, potentially leading to full system compromise, data exfiltration, or disruption of critical infrastructure operations.","remediation":"Upgrade to openPDC version 2.590 or later and openHistorian version 2.590 or later to remediate this vulnerability.","detection":"Monitor for unusual file creation or modification in directories where openPDC/openHistorian components are loaded, particularly looking for new .dll or .exe files that could be loaded as components. Also monitor for process execution patterns that might indicate component loading from unexpected locations.","tags":["rce","privilege-escalation","ics","component-loading"],"model":"garnet-coder","analyzedAt":"2026-10-13T08:51:14.892Z"}}