openPDC's Docker image carries all six CVEs listed in CISA advisory

The advisory text is not enough to rate how exploitable these flaws are. For each product, CISA's listing gives CVE identifiers and version thresholds ^[11]. It does not say what any of the six flaws lets an attacker do, or how severe each one is ^[11].

The version thresholds hold the detail operators can act on. Each product is listed against two bounds: openPDC below 2.9.477 and below 2.9.482 ^[1], and openHistorian below 2.8.580 and below 2.8.585 ^[3]. The Docker image is listed against the same two bounds as a native openPDC install ^[17]. On the listing as written, reaching the lower number does not take a system off it. An openPDC build at 2.9.477 or later but below 2.9.482 still falls inside the second range. So does an openHistorian build from 2.8.580 up to but not including 2.8.585 ^[16].

CISA's mitigations are its standard set for control systems. Keep control system devices off the internet. Put control networks behind firewalls, isolated from business networks. When remote access is required, use more secure methods such as VPNs ^[7]. The advisory adds that VPNs can have vulnerabilities of their own and should be kept on the current version, and that a VPN "is only as secure as the connected devices" ^[8]. It also tells organisations to do an impact analysis and risk assessment before deploying any of these measures ^[12].

On the public record, this is a single disclosure made through CISA ^[5], with an initial release date of 2026-10-08 ^[9]. If your openPDC and openHistorian servers are already isolated the way CISA describes, I'd do the upgrade in the next scheduled maintenance window ^[6][7]. CISA asks any organisation that sees suspected malicious activity to report it, so the agency can check it against other incidents ^[10].