Critical mySCADA myPRO Manager Flaw Exposes Privileged Controls Without Authentication

CISA has disclosed two authentication and authorization vulnerabilities in mySCADA Technologies’ myPRO Manager, including a critical flaw that exposes privileged management functions to network attackers.

The vulnerabilities affect mySCADA myPRO Manager versions 2.1 and earlier. The product is deployed worldwide in Critical Manufacturing, Energy, Food and Agriculture, Transportation Systems, and Water and Wastewater environments.

CISA published advisory ICSA-26-258-03 on September 15, 2026. Shirshak Secnora OÜ reported both issues to the agency.

No fixed version or vendor patch has been identified. Operators must currently rely on network restrictions, segmentation, and monitoring to reduce their exposure.

Command API flaw gives attackers privileged access

The more serious vulnerability, CVE-2026-73807, is a missing-authorization weakness in the myPRO Manager command API.

An attacker who can send network requests to the affected API does not need to authenticate before invoking privileged functionality. Exploitation also requires no user interaction and is considered low complexity.

The flaw carries a CVSS v3.1 score of 9.8 and the following vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Its CVSS v4.0 score is 9.3:

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CISA classifies the vulnerability as CWE-862, or Missing Authorization. The problem is not that an attacker can bypass a particular login mechanism. Instead, the command API fails to enforce the authorization check required before carrying out sensitive operations.

The assessed confidentiality, integrity, and availability impacts are all high. Depending on how an organization has deployed myPRO Manager, unauthorized access could expose management data, permit changes to operational or system configurations, and interrupt services.

That combination is particularly serious in industrial environments. A management interface may sit above multiple devices or processes, so compromise of the interface can have consequences beyond the server hosting it. The specific commands exposed through exploitation and the extent of downstream control have not been disclosed.

Notification gateway permits arbitrary SMS messages

The second issue, CVE-2026-82567, affects the notification gateway used with an attached GSM modem.

The gateway provides an HTTP endpoint that accepts a recipient telephone number and message body. It does not require the requester to authenticate before passing that information to the modem for transmission.

An attacker with the necessary network position could consequently send arbitrary SMS messages using the organization’s connected modem. Unlike CVE-2026-73807, the published scoring describes this as an adjacent-network attack rather than one available through general network reachability.

CVE-2026-82567 has a CVSS v3.1 score of 6.3:

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Its CVSS v4.0 score is 5.3:

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

The weakness is categorized as CWE-306, Missing Authentication for Critical Function. No privileges or user interaction are required once the attacker can reach the gateway.

The immediate effects may include telecommunications charges, unauthorized communications, or exhaustion and misuse of notification resources. The endpoint could also be used to send misleading messages from a telephone number that employees recognize as belonging to a trusted operational system.

That creates a distinct operational problem. Even if the SMS flaw does not provide administrative control over myPRO Manager, fraudulent alerts could confuse personnel or interfere with workflows that depend on text messages for incident notification.

Worldwide industrial deployments face different exposure paths

Both vulnerabilities affect myPRO Manager versions up to and including 2.1, but they should not be treated as identical network risks.

CVE-2026-73807 is remotely exploitable over a network when the attacker can reach the command API. Its critical rating reflects the lack of authentication, low attack complexity, and potentially broad impact on the affected system.

CVE-2026-82567 requires access from an adjacent network according to its CVSS vectors. This limits the expected attack path, but it does not make the issue harmless. An attacker who compromises another host on the relevant segment may be able to reach the SMS endpoint from inside the environment.

Network architecture will therefore determine practical exposure. An internet-accessible management interface creates a substantially different risk from an interface restricted to a dedicated control segment and a small set of administrative hosts.

The affected vendor, mySCADA Technologies, is headquartered in Czechia. Exact deployment numbers and the identities of affected customers have not been disclosed.

No patch or fixed release has been announced

The available remediation information does not identify a corrected myPRO Manager version. Organizations running version 2.1 or earlier should not assume that an update is available unless mySCADA Technologies provides separate guidance.

Until a fix is confirmed, operators should identify every affected instance and document which systems can communicate with its command API and notification gateway. Public internet access should be removed.

Firewall rules and network allowlists should restrict both interfaces to the minimum number of trusted hosts. Control-system networks should also remain separated from business environments, limiting the paths an attacker could use after compromising a corporate endpoint.

Remote administration should pass through a controlled access mechanism such as a maintained VPN. A VPN does not correct either vulnerability; it only reduces who can reach the vulnerable service. The VPN infrastructure and connecting devices must themselves be securely configured and updated.

Operators should assess the operational effect of any firewall or segmentation change before deployment. Abruptly blocking communication in an industrial environment can interrupt legitimate management, telemetry, or notification functions.

Where the GSM feature is unnecessary, organizations should consider preventing network access to its gateway or disconnecting the modem, subject to operational approval. If SMS notifications remain required, only designated application hosts should be able to submit requests.

Defenders should review API and modem activity

CISA said it had received no reports of known public exploitation specifically targeting either vulnerability when the advisory was issued. No vulnerability-specific indicators of compromise have been published.

There is also no disclosed CISA Known Exploited Vulnerabilities catalog entry or associated federal remediation deadline for these CVEs. The absence of reported exploitation does not establish that exposed systems have not been probed or abused.

Defenders can review web, reverse-proxy, firewall, and application logs for unexpected access to myPRO Manager management functions. Requests originating outside approved administration systems deserve particular attention, especially if they coincide with configuration changes or service disruption.

For CVE-2026-82567, operators should compare gateway activity with GSM modem records, SMS delivery logs, and telecommunications billing. Messages sent to unfamiliar numbers, unusual bursts of transmission, or content that does not match established alert templates may indicate misuse.

Organizations that identify suspicious activity should follow their industrial incident-response procedures, preserve relevant network and application evidence, and report findings to CISA. Until a vendor fix is available, tightly controlling reachability remains the primary defense.