mySCADA myPRO Manager flaws allow unauthenticated access
Two vulnerabilities in mySCADA myPRO Manager (<=2.1) let unauthenticated attackers access privileged functions or send arbitrary SMS via the GSM modem; patch to v2.2.
Sourcecisa.gov — open the original
What to check
- Applies to
- The 2 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CISA published an ICS advisory for mySCADA myPRO Manager, an industrial SCADA management product used worldwide across critical manufacturing, energy, food and agriculture, transportation, and water/wastewater sectors. Two vulnerabilities affect versions 2.1 and earlier: CVE-2026-73807, a missing authorization flaw (CWE-862) in the command API that lets an unauthenticated attacker with network access reach privileged management functions; and CVE-2026-82567, a missing authentication issue (CWE-306) in the notification gateway that exposes an unauthenticated HTTP endpoint capable of sending arbitrary SMS messages through a connected GSM modem.
Both issues require only network access to the exposed APIs and no credentials, making internet-exposed or poorly segmented deployments the primary risk. mySCADA Technologies has released version 2.2 to remediate both issues; the product notifies internet-connected devices of the update, and offline instances can be updated manually from the vendor's download page. CISA reports no known public exploitation of these vulnerabilities at this time and recommends standard ICS network isolation, firewalling, and secure remote access (VPN) practices as compensating controls.
Defenders operating mySCADA myPRO Manager should prioritize verifying network exposure of the command API and notification gateway, ensure these interfaces are not reachable from the internet or business networks, and apply version 2.2 as soon as feasible. The SMS abuse vector (CVE-2026-82567) could also be leveraged for social engineering, spam, or disruption of alerting workflows if the GSM modem is used for operational notifications.
Mentioned in this report
Detection guidance
mySCADA myPRO Manager HTTP Access from External Networks
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects HTTP/HTTPS connections to mySCADA myPRO Manager instances from non-RFC1918 source IPs, indicating internet exposure of the application. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: mySCADA myPRO Manager HTTP Access from External Networks
description: Detects HTTP or HTTPS traffic to mySCADA myPRO Manager (default ports
80, 443, or 8080) originating from external (non-private) IP addresses. Indicates
potential internet exposure of the vulnerable application.
tags:
- attack.t1190
logsource:
category: network_connection
product: windows
detection:
selection:
DestinationHostname|contains: myscada
DestinationPort:
- 80
- 443
- 8080
filter_private_source:
SourceIp|cidr:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
- 127.0.0.0/8
condition: selection and not filter_private_source
falsepositives:
- Legitimate remote management from authorized external networks via VPN
- Intentional internet-exposed instances with compensating security controls
level: medium
id: f0d6cc35-c2a0-5026-9d74-3e8ff285a6d3
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-258-03
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs