mySCADA myPRO Manager: Two Missing-Authorization Flaws in an ICS Management Platform (Control Network Focus)

The mySCADA myPRO Manager platform has been identified as having two missing-authorization vulnerabilities, CVE-2026-73807 and CVE-2026-82567, according to a CISA advisory. The vulnerabilities allow unauthenticated access to management functions, enabling an attacker to change how the control system reports and potentially disrupt its operations.

Version 2.2 of the software resolves the issues, with no public exploitation reported. The vulnerabilities exist due to insufficient authentication checks on the command API and notification gateway endpoints. These flaws can be exploited without credentials, provided there is network access to the relevant service. The only requirement is that the attacker can reach the service, which is often a matter of accessing the same VLAN as the affected system.

The impact of these vulnerabilities can be significant for operators in manufacturing, energy, water, or transportation sectors, as it results in lost visibility and potential process disruption. The SMS gateway also provides an internal-looking channel, making the messages more convincing than an external phishing attempt. The affected products are versions 2.1 and earlier of mySCADA myPRO Manager, with version 2.2 resolving the issues.