mySCADA myPRO Manager: 2 CVEs, Critical 9.8
Summary
CISA reports 2 vulnerabilities in mySCADA Technologies mySCADA myPRO Manager. Weakness types: Missing Authorization, Missing Authentication for Critical Function. Successful exploitation of these vulnerabilities could allow an attacker to access privileged management functions or send arbitrary SMS messages through the connected GSM modem. Highest CVSS v3 score: 9.8 (Critical), exploitable over the network.
At a glance
- Vendor
- mySCADA Technologies
- Products
- mySCADA myPRO Manager
- CVEs
- CVE-2026-73807, CVE-2026-82567
- Highest CVSS v3
- 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Highest CVSS v4
- –
- Known exploited (KEV)
- No CVE from this advisory is on the KEV list as of the last refresh
- Sectors (per CISA)
- Critical Manufacturing, Energy, Food and Agriculture, Transportation Systems, Water and Wastewater
- Deployed
- Worldwide
- Vendor HQ
- Czechia
Vulnerabilities
| CVE | Weakness | CVSS v3 | CVSS v4 | KEV | Description (from advisory) |
|---|---|---|---|---|---|
| CVE-2026-73807 | Missing Authorization | 9.8 | – | No | The mySCADA myPRO Manager command API does not properly enforce authentication for privileged functions. An unauthenticated attacker with network access to the affected API could exploit this vulnerability to access privileged management functions. |
| CVE-2026-82567 | Missing Authentication for Critical Function | 6.3 | – | No | The myPRO Manager notification gateway exposes an unauthenticated HTTP endpoint used to send SMS messages through a connected GSM modem. The endpoint is accessible over the network and does not require authentication before accepting a phone number and message from a request and sending the specified SMS message. An unauthenticated attacker with network access to the notification gateway could exp… |
Affected products (1)
- mySCADA Technologies mySCADA myPRO Manager: <=2.1
Vendor fixes and mitigations (from advisory)
- Mitigation: mySCADA Technologies has addressed these issues in Version 2.2 and recommends that users update to the latest version. Users are notified in mySCADA Pro Manager about the availability of a new version if the device is connected to the internet. Otherwise, users can download the mySCADA Pro Manager from the webpage. link
Also apply CISA's standard ICS practices: minimize network exposure, keep control networks behind firewalls and isolated from business networks, and use up-to-date secure remote access.
Sources
This page is generated automatically from the CISA advisory text. It is not a substitute for the vendor's guidance; verify affected versions and fixes at the source before making changes to control systems.