Which openPDC and openHistorian versions are listed as affected in CISA advisory ICSA-26-281-02?
CISA advisory ICSA-26-281-02 lists affected version thresholds for both openPDC and openHistorian.
The affected version thresholds
The supplied context says CISA lists these as affected:
| Product | Versions listed as affected |
|---|---|
| openPDC | Versions below 2.9.477 and below 2.9.482 |
| openHistorian | Versions below 2.8.580 and below 2.8.585 |
The advisory also lists corresponding openPDC Docker image versions, but the supplied context does not provide the exact Docker image identifiers.
What to check first
Start with an inventory of your installed openPDC and openHistorian versions. Compare them with the thresholds in the CISA advisory.
If you use openPDC Docker images, check the official advisory for the corresponding image versions because the provided context confirms they exist but does not list their exact values.
What not to infer
Do not assume a version is unaffected based only on product name or deployment type. The context confirms affected thresholds, the advisory code, and that Docker image versions are also covered, but it does not provide remediation steps.
Review the CISA advisory directly before taking action, since version guidance can change.
What risks does CISA identify for openPDC in the October 08, 2026 advisory?
CISA’s October 08, 2026 advisory identifies five vulnerability categories for openPDC and assigns a CVSS v3 score of 9.8.
The risks named in the advisory
The supplied context says the openPDC vulnerability categories include:
- Untrusted-data deserialization
- Missing authentication for a critical function
- Server-side request forgery, or SSRF
- Hard-coded credentials
- Unsafe reflection
CISA describes five openPDC vulnerabilities in the advisory.
Why operators should pay attention
A CVSS v3 score of 9.8 is the score CISA assigns in the supplied context. The advisory places the products in the Energy sector and says deployment is worldwide.
That combination makes version review important for teams that operate openPDC in covered environments.
What is not included in the context
The supplied facts do not include exploit details, mitigation steps, fixed version instructions, or configuration-specific guidance. Use the official CISA advisory for the current technical details before changing systems.
Should Energy-sector operators with worldwide deployments review the openPDC and openHistorian advisory?
Yes. Energy-sector operators should review CISA advisory ICSA-26-281-02 if they use Grid Protection Alliance openPDC or openHistorian.
Who the advisory is aimed at
The supplied context says CISA places the products in the Energy sector and says deployment is worldwide.
That means the advisory is especially relevant for teams managing:
- openPDC deployments
- openHistorian deployments
- openPDC Docker images
- Energy-sector environments using these products globally
What the advisory covers
CISA issued the advisory on October 08, 2026 under alert code ICSA-26-281-02.
It lists affected openPDC versions below 2.9.477 and below 2.9.482, along with corresponding openPDC Docker image versions. It also lists openHistorian versions below 2.8.580 and below 2.8.585 as affected.
What to do with that information
Use the advisory to compare your product inventory with CISA’s affected version thresholds. The supplied context does not include patch procedures or operational workarounds, so confirm those details on the official CISA page.
How do the affected openPDC Docker image versions relate to the listed openPDC version thresholds?
CISA’s advisory treats openPDC Docker images as part of the same version-review problem, but the supplied context does not give the exact image version labels.
The relationship CISA identifies
The context says CISA lists affected openPDC versions below 2.9.477 and below 2.9.482, along with corresponding openPDC Docker image versions.
So the practical takeaway is:
- Installed openPDC versions need to be checked against the listed thresholds.
- openPDC Docker image versions also need to be checked against the corresponding Docker entries in the advisory.
- The Docker image list should not be guessed from the installed-version thresholds alone.
Why the distinction matters
A system may use an installed openPDC version, a Docker image, or both across different environments. The context confirms that CISA addressed both installed versions and Docker image versions, but it does not provide the exact Docker image identifiers.
Best next step
Open the official CISA advisory and compare both inventories: installed openPDC versions and openPDC Docker image versions.
Because the exact image values are not included in the supplied context, use CISA’s current advisory text for that part of the check.
Sources / Learn more
Related reading
- Which ABB PCM600 versions are affected by the October 1, 2026 CISA advisory?; What should energy-sector operators check in ABB PCM600 after the CISA advisory?; What changes in risk does the PCM600 Scheduler Service vulnerability create for standard users?
- How do I update a Eufy Omni C20 or Omni X10 Pro to firmware version 1.6.4 or later?; Which Eufy Omni C20 and Omni X10 Pro firmware versions are affected by the September 24, 2026 CISA advisory?; What should I do if my Eufy Omni C20 or Omni X10 Pro was paired while running firmware before 1.6.4?; What changed in the CISA advisory for Eufy Omni C20 and Omni X10 Pro released on September 24, 2026?
- What changed for Andy Green when the Mets removed his interim tag and made him full-time manager?
- What happened with Riley Green’s 2019 song lyric referencing Robert E. Lee, and is it still on streaming?
Leave a Reply