CVE-2026-73807 and CVE-2026-82567: Missing Authorization in mySCADA myPRO Manager

Vulnerability overview

CISA disclosed two missing-authorization vulnerabilities in mySCADA myPRO Manager. CVE-2026-73807 is rated 9.8 on the CVSS v3 scale; CVE-2026-82567 is rated 6.3. mySCADA Technologies released version 2.2 with fixes. Neither flaw has confirmed exploitation in the wild.

Mechanism and exploitation conditions

The advisory describes CVE-2026-73807 as a failure to enforce authentication in the myPRO Manager command API. The API is meant to serve privileged management operations, and the authentication check that should precede them does not hold. An unauthenticated attacker who can send requests to the API can invoke those operations.
CVE-2026-82567 is a missing authentication check in the notification gateway. The gateway exposes an HTTP endpoint for sending SMS messages through a GSM modem, and the endpoint accepts unauthenticated requests. Supplying a message payload is sufficient to make the modem send it.
Both require network access to the affected interface. Neither requires an account, a session, or any prior access to the platform.

Impact

The command API flaw lets an attacker reach privileged functions without credentials. In an industrial setting, that can mean manipulating the management interface operators rely on, changing configuration, or interfering with process control.
The SMS gateway flaw lets an attacker send messages that appear to come from the operator's own system. That is a credible pretext for social engineering against plant staff, and it consumes the operator's GSM airtime.

Affected products and scope

mySCADA myPRO Manager version 2.1 and earlier is affected. Version 2.2 contains the fixes. The advisory does not describe a configuration that avoids the flaws, so the affected surface is the product's standard management and alerting functionality.

Exposure context

A ZoomEye query for title="mySCADA" returned 651 assets on 2026-09-16. That count describes systems presenting the product title on reachable networks. It does not confirm a vulnerable version or an exposed endpoint, so it is a deployment indicator rather than a measure of exploitable hosts.

Remediation and mitigations

Install version 2.2 and confirm the version in the product interface. If the upgrade has to wait, block network access to the command API and the notification gateway, and disable the SMS gateway where it is not in use.
For monitoring, alert on unauthenticated calls to management endpoints and on outbound SMS activity with no corresponding operator action.

References

• SecurityOnline, "Critical mySCADA myPRO Manager Vulnerabilities Patched": https://securityonline.info/myscada-mypro-manager-vulnerabilities/
• CISA ICS advisories: https://www.cisa.gov/news-events/ics-advisories
• ZoomEye query title="mySCADA", executed 2026-09-16: https://www.zoomeye.ai/searchResult?q=dGl0bGU9Im15U0NBREEi