Live 307 sources monitored São Paulo Washington London Frankfurt Dubai Hong Kong Sydney 7 regions
✦ RegulusGlobal regulatory broadcast network
CISA Advisories United States AI, Technology & Data Operational resilience ✓ 17 claims checked 16 Oct 2026

CISA details five flaws in energy-sector tools openPDC and openHistorian

Regulus briefing
1:02 · CISA Advisories · 08 Oct 2026

CISA has published an advisory covering five vulnerabilities in Grid Protection Alliance's openPDC and openHistorian, software deployed worldwide in the energy sector for grid data collection and storage. The advisory sets out affected versions, remediation status and mitigation steps for operators running these systems, with Docker image deployments left without a vendor fix for several of the flaws.

  • CISA's advisory lists five vulnerabilities affecting openPDC versions below 2.9.477/2.9.482 and openHistorian versions below 2.8.580/2.8.585.
  • CVE-2026-100730 and CVE-2026-105278 each carry a CVSS 3.1 base score of 9.8, rated critical.
  • Grid Protection Alliance has no fix planned for the Docker image and does not recommend its production use, per the advisory.
  • A Modbus connection feature (CVE-2026-101022) lets an authenticated user target arbitrary internal network destinations, enabling internal network mapping.
  • Shubham Raj of Causal Security reported the vulnerabilities to CISA, which released the advisory on 8 October 2026.

Executive summary

CISA published advisory ICSA-26-281-02 on 8 October 2026 covering five vulnerabilities in Grid Protection Alliance's openPDC and openHistorian, software used worldwide in the energy sector and headquartered in the United States. Affected versions are openPDC below 2.9.477 and 2.9.482, and…

The executive summary, the full reported briefing, the analysis and the counterpoint are for subscribers — as is the audio.

You are not charged for 3 days and you can cancel at any time. Already subscribe? Sign in to hear this and everything else published today.

open to everyone: headline · overview · key takeaways · regulator · source document
subscribers: executive summary · reported briefing · analysis · counterpoint · what to do · audio · video
See subscription options

Source documents

https://www.cisa.gov/news-events/ics-advisories/icsa-26-281-02
Published by CISA Advisories · 08 Oct 2026
Read by Regulus 16 Oct 2026 at 13:24 UTC
17 factual claims checked against this document · 0 unsupported
Cited and linked; extract quoted under fair dealing

Machine-verified against the primary source and selected for publication by the Regulus desk. Not individually read by an editor. Lead briefings and anything our checks flag always are — how we review.