mySCADA myPRO Manager: Two Missing-Authorization Flaws in an ICS Management Platform

Vulnerability overview

CISA published an advisory covering two authorization weaknesses in mySCADA myPRO Manager, an HMI/SCADA management component from mySCADA Technologies. The more serious issue, CVE-2026-73807, carries a CVSS v3 score of 9.8. The second, CVE-2026-82567, is rated 6.3.
Both are described as missing-authorization defects. Neither requires the attacker to hold credentials, and neither has been linked to confirmed exploitation at the time of disclosure. Patches are available in version 2.2.

Mechanism and exploitation conditions

CVE-2026-73807 sits in the myPRO Manager command API. The advisory states that this API "does not properly enforce authentication for privileged functions." In practice, an endpoint that should reject unauthenticated callers accepts them, and the caller reaches management operations that are meant to be restricted.
CVE-2026-82567 affects the notification gateway. That component exposes an HTTP endpoint used to dispatch SMS messages through an attached GSM modem, and the endpoint does not verify who is calling it. A network request carrying a message payload is enough to trigger a send.
Exploitation requires network reachability to the affected interface. An attacker who can route packets to the command API or the notification gateway does not need a session, a token, or a valid account.

Impact

Reaching the command API gives an attacker access to privileged management functions. On an industrial control deployment, that can mean altering configuration, disrupting process visibility, or interfering with the operator's ability to control equipment.
The notification gateway adds a second, less obvious consequence. Because the SMS path runs through a physical GSM modem, an attacker can use the appliance to send messages that appear to originate from the operator's own infrastructure. That is useful for social engineering against staff who trust messages from the plant's monitoring system, and it can generate carrier charges on the operator's account.

Affected products and scope

mySCADA myPRO Manager version 2.1 and earlier is affected. mySCADA Technologies resolved both defects in version 2.2. The advisory does not describe a configuration that avoids the flaws; the affected code paths are part of the product's normal management and alerting functions.

Exposure context

A ZoomEye query for title="mySCADA" returned 651 matching assets on 2026-09-16. That figure counts systems whose page title matches the product string. It does not establish that any of them run a vulnerable version or expose the affected endpoints to the internet, so it should be read as an indicator of how widely the product is deployed on reachable networks rather than a count of confirmed vulnerable hosts.

Remediation and mitigations

Upgrade myPRO Manager to version 2.2. That is the only action that removes the flaws.
Where the upgrade cannot be applied immediately, restrict who can reach the command API and the notification gateway. Place both behind a firewall or an access-controlled segment, and do not expose them to untrusted networks. If the SMS gateway is not needed, disable it. Review logs for unauthenticated calls to management endpoints and for outbound SMS activity that no operator initiated.
After upgrading, confirm the running version in the product interface rather than relying on the installer having completed.

References

• SecurityOnline, "Critical mySCADA myPRO Manager Vulnerabilities Patched": https://securityonline.info/myscada-mypro-manager-vulnerabilities/
• CISA ICS advisories: https://www.cisa.gov/news-events/ics-advisories
• ZoomEye query title="mySCADA", executed 2026-09-16: https://www.zoomeye.ai/searchResult?q=dGl0bGU9Im15U0NBREEi