VORANT. Threat Intelligence Sign in Get the full feed

mySCADA myPRO Manager flaws allow unauthenticated access

routine vulnerability manufacturingenergytransportationinfrastructure

Two vulnerabilities in mySCADA myPRO Manager (<=2.1) let unauthenticated attackers access privileged functions or send arbitrary SMS via the GSM modem; patch to v2.2.

CISA published an ICS advisory for mySCADA myPRO Manager, an industrial SCADA management product used worldwide across critical manufacturing, energy, food and agriculture, transportation, and water/wastewater sectors. Two vulnerabilities affect versions 2.1 and earlier: CVE-2026-73807, a missing authorization flaw (CWE-862) in the command API that lets an unauthenticated attacker with network access reach privileged management functions; and CVE-2026-82567, a missing authentication issue (CWE-306) in the notification gateway that exposes an unauthenticated HTTP endpoint capable of sending arbitrary SMS messages through a connected GSM modem.

Both issues require only network access to the exposed APIs and no credentials, making internet-exposed or poorly segmented deployments the primary risk. mySCADA Technologies has released version 2.2 to remediate both issues; the product notifies internet-connected devices of the update, and offline instances can be updated manually from the vendor's download page. CISA reports no known public exploitation of these vulnerabilities at this time and recommends standard ICS network isolation, firewalling, and secure remote access (VPN) practices as compensating controls.

Defenders operating mySCADA myPRO Manager should prioritize verifying network exposure of the command API and notification gateway, ensure these interfaces are not reachable from the internet or business networks, and apply version 2.2 as soon as feasible. The SMS abuse vector (CVE-2026-82567) could also be leveraged for social engineering, spam, or disruption of alerting workflows if the GSM modem is used for operational notifications.

Mentioned in this report

Vulnerabilities CVE-2026-73807CVE-2026-82567

Detection guidance

Unauthenticated Access to mySCADA myPRO Manager Command API

ATT&CK T1190

Detects HTTP requests to mySCADA myPRO Manager command API endpoints without authentication headers, exploiting CVE-2026-73807. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Unauthenticated Access to mySCADA myPRO Manager Command API
description: Detects unauthenticated HTTP requests to mySCADA myPRO Manager command
  API endpoints. CVE-2026-73807 allows attackers without credentials to reach privileged
  management functions via missing authorization in the API.
tags:
- attack.t1190
- cve.2026-73807
logsource:
  category: proxy
  product: proxy
detection:
  selection_url:
    c-uri|contains:
    - /api/command
    - /command/
  selection_host:
    cs-host|contains: myscada
  selection_no_auth:
    cs-Authorization|exists: false
  selection_http:
    cs-method:
    - GET
    - POST
    - PUT
    - DELETE
  condition: selection_url and selection_host and selection_no_auth and selection_http
falsepositives:
- Legitimate unauthenticated health checks or status probes from monitoring systems
- Vendor diagnostic tools that bypass authentication
level: high
id: fd9469ee-0a86-5fe6-ab9f-6cba2b573cd2
status: experimental
author: Vorant

Unauthenticated Access to mySCADA myPRO Manager Notification Gateway

ATT&CK T1190

Detects HTTP requests to mySCADA myPRO Manager notification gateway endpoints without authentication, exploiting CVE-2026-82567 to send arbitrary SMS messages. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Unauthenticated Access to mySCADA myPRO Manager Notification Gateway
description: Detects unauthenticated HTTP requests to mySCADA myPRO Manager notification
  gateway endpoints. CVE-2026-82567 exposes an HTTP endpoint that allows unauthenticated
  attackers to send arbitrary SMS messages through connected GSM modems.
tags:
- attack.t1190
- cve.2026-82567
logsource:
  category: proxy
  product: proxy
detection:
  selection_url:
    c-uri|contains:
    - /notification
    - /gateway
    - /sms
  selection_host:
    cs-host|contains: myscada
  selection_no_auth:
    cs-Authorization|exists: false
  selection_http:
    cs-method:
    - GET
    - POST
  condition: selection_url and selection_host and selection_no_auth and selection_http
falsepositives:
- Legitimate notification test requests from authorized administrators
- Vendor status endpoints that intentionally do not require authentication
level: high
id: 7d61d1b5-be5a-534e-ac35-0c5114d4a378
status: experimental
author: Vorant

mySCADA myPRO Manager HTTP Access from External Networks

ATT&CK T1190

Detects HTTP/HTTPS connections to mySCADA myPRO Manager instances from non-RFC1918 source IPs, indicating internet exposure of the application. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: mySCADA myPRO Manager HTTP Access from External Networks
description: Detects HTTP or HTTPS traffic to mySCADA myPRO Manager (default ports
  80, 443, or 8080) originating from external (non-private) IP addresses. Indicates
  potential internet exposure of the vulnerable application.
tags:
- attack.t1190
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationHostname|contains: myscada
    DestinationPort:
    - 80
    - 443
    - 8080
  filter_private_source:
    SourceIp|cidr:
    - 10.0.0.0/8
    - 172.16.0.0/12
    - 192.168.0.0/16
    - 127.0.0.0/8
  condition: selection and not filter_private_source
falsepositives:
- Legitimate remote management from authorized external networks via VPN
- Intentional internet-exposed instances with compensating security controls
level: medium
id: f0d6cc35-c2a0-5026-9d74-3e8ff285a6d3
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-258-03

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free