Today's briefing covers three CISA items dated 2026-10-08: ICS advisory ICSA-26-281-02 for Grid Protection Alliance openPDC and openHistorian, where a service console interface deserializes client-supplied data and can yield remote code execution, with an aggregate CVSS v3 score of 9.8; a Known Exploited Vulnerabilities entry for CVE-2016-3081, an Apache Struts command injection flaw with a remediation due date of 2026-10-11; and ICS advisory ICSA-26-281-01 for Red Lion Controls N-Tron 700 Series switches, where default factory credentials with administrative access persist and a specific URL triggers a reboot that can be scripted into a continuous loop. The energy-sector advisory and the decade-old Struts flaw share the same underlying condition: a code path that executes attacker-controlled input is reachable without the authentication the deployment assumed.
CISA advisory ICSA-26-281-02 covers Grid Protection Alliance openPDC and openHistorian, products from a United States-headquartered vendor deployed worldwide in the Energy critical infrastructure sector. The advisory lists openPDC versions earlier than 2.9.477 and earlier than 2.9.482, the openPDC Docker image in the same ranges, and openHistorian versions earlier than 2.8.580 and earlier than 2.8.585 as affected. Five vulnerability classes are listed with an aggregate CVSS v3 score of 9.8: deserialization of untrusted data, missing authentication for critical function, server-side request forgery, use of hard-coded credentials, and use of externally-controlled input to select classes or code, which CISA labels unsafe reflection. The CVE identifiers are CVE-2026-104629, CVE-2026-100730, CVE-2026-105281, CVE-2026-85479, and CVE-2026-101022, with CVE-2026-105278 additionally listed against the Docker image. The detailed entry for CVE-2026-100730 describes a service console interface on both products that deserializes a client-supplied data structure. On systems using Windows Authentication an attacker must already be authenticated to reach this function; on systems without Windows Authentication it is reachable by an unauthenticated network attacker. In either case the attacker can trigger deserialization of an arbitrary object graph, which could allow remote code execution under the privileges of the affected service account.
A 9.8 aggregate score on software deployed in the Energy sector is serious on its own, but the operational detail that determines exposure is the authentication mode: deployments that do not use Windows Authentication expose the deserialization path to any peer that can reach the service console port, and the attacker lands with the service account's privileges on a host inside the operational network. Operators should record which authentication mode each openPDC and openHistorian instance runs, including Docker deployments, move every instance to a version outside the affected ranges named in the advisory, restrict network access to the service console interface to designated management hosts, and review the hard-coded credential and server-side request forgery findings in the same change window, since an attacker who reaches the host can use both to move further.
CISA added CVE-2016-3081 to the Known Exploited Vulnerabilities catalog on 2026-10-08. The entry describes a command injection vulnerability in Apache Struts that could allow remote attackers to execute arbitrary code via the method: prefix when Dynamic Method Invocation is enabled. The required action is to apply mitigations in accordance with vendor instructions, ensuring compliance with CISA's BOD 26-04 Prioritizing Security Updates Based on Risk guidance and CISA's Forensics Triage Requirements, to follow applicable BOD 26-04 guidance for cloud services, or to discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. The catalog lists the due date as 2026-10-11 and records known ransomware campaign use as unknown.
A flaw first identified in 2016 entering the catalog in 2026 with a three-day due date means CISA regards exploitation as current, and the precondition named in the entry, Dynamic Method Invocation enabled, is a configuration state rather than a version number, so the setting has to be checked alongside the library version. Operators should inventory every application that embeds Struts, including vendor appliances and internal tools that are no longer under active development, confirm that Dynamic Method Invocation is disabled, and apply the vendor's mitigations. Federal civilian agencies are bound by the BOD 26-04 deadline; everyone else should read the short window as a priority signal. The reference to Forensics Triage Requirements is a reminder that a host that has been running an exposed Struts build should be examined for prior compromise, not only patched.
CISA advisory ICSA-26-281-01 covers Red Lion Controls N-Tron 700 Series switches, deployed worldwide across the Commercial Facilities, Communications, Critical Manufacturing, and Information Technology critical infrastructure sectors. Affected versions are 700 Series firmware 3.11.0 and earlier and bootloader 2.0.6.1 and earlier. The advisory lists seven CVEs, CVE-2026-32645, CVE-2026-39460, CVE-2026-28745, CVE-2026-33367, CVE-2026-29797, CVE-2026-39453, and CVE-2026-33272, with an aggregate CVSS v3 score of 8.3, across seven weakness classes: use of hard-coded credentials, insufficiently protected credentials, storing passwords in a recoverable format, missing authentication for critical function, download of code without integrity check, reachable assertion, and authentication bypass using an alternate path or channel. Successful exploitation could allow a malicious user to access the device and gain administrative access, which would allow the user to view, edit, and upload configuration files. Separately, a malicious user can cause the switch to reboot by navigating to a specific URL on the device, and that action can be scripted from the attacker's own machine to cause continuous rebooting. The detailed entry for CVE-2026-32645 describes default factory credentials with administrative access that are enabled and persist on the device.
Persistent default administrative credentials reduce the attack on a managed switch to knowing the credential and reaching the management interface, and the download-of-code-without-integrity-check finding means that the same access can be used to load code the device will not verify. The scripted reboot is a low-skill availability attack against every segment the switch serves, which in the listed sectors includes manufacturing lines and communications paths. Operators should identify every 700 Series unit, record firmware and bootloader versions against the affected ranges, keep switch management interfaces off production and corporate networks, and verify after any vendor update that the factory credentials are actually disabled rather than assumed to be.
