A pair of vulnerabilities in mySCADA myPRO Manager could let an unauthenticated network attacker reach privileged management functions or send arbitrary text messages through a connected GSM modem, the Cybersecurity and Infrastructure Security Agency said in an advisory published September 15, 2026. The affected industrial-control software is deployed worldwide, with listed use across critical manufacturing, energy, food and agriculture, transportation systems, and water and wastewater operations.
The more severe issue, CVE-2026-73807, affects the product’s command API. The API does not properly enforce authentication for privileged functions, allowing an attacker with network access to invoke those functions without credentials. CISA assigns the vulnerability a CVSS 3.1 score of 9.8, or critical severity, with a vector indicating that exploitation requires no privileges or user interaction and can affect confidentiality, integrity, and availability. Under the newer CVSS 4.0 scoring system, CISA lists a score of 9.3, also in the critical range.
A second flaw, CVE-2026-82567, affects the myPRO Manager notification gateway. Its HTTP endpoint accepts a phone number and message without authentication and sends the specified SMS through a connected GSM modem. CISA rates that vulnerability medium severity, with a CVSS 3.1 score of 6.3. The issue could allow unauthorized messages to be sent using the modem associated with an affected system. CISA lists a CVSS 4.0 score of 5.3 for the same vulnerability.
The two weaknesses involve different access-control failures. CVE-2026-73807 is classified as missing authorization because the command API does not adequately restrict privileged functions. CVE-2026-82567 is classified as missing authentication for a critical function because the notification endpoint accepts a message request without first verifying the caller’s identity. Both vulnerabilities require network access to the relevant interface, but neither requires valid credentials under the conditions described by CISA.
The potential consequences also differ. Exploitation of the command API could provide access to privileged management functions, giving an attacker a path to perform administrative actions through the software. Exploitation of the notification gateway could cause the connected GSM modem to transmit attacker-selected messages to a specified phone number. CISA’s summary groups the risks as unauthorized access to management functions and arbitrary SMS delivery through the connected modem.
mySCADA Technologies has addressed both issues in version 2.2 and recommends that users update to the latest release. The advisory says mySCADA Pro Manager notifies users when a new version is available if the device is connected to the internet. CISA identifies version 2.2 as the vendor’s mitigation for both CVE-2026-73807 and CVE-2026-82567.
Until updates are applied, CISA recommends minimizing network exposure for control-system devices and ensuring that they are not accessible from the internet. The agency also advises placing control-system networks and remote devices behind firewalls and isolating them from business networks. Where remote access is necessary, CISA recommends more secure methods such as virtual private networks, while warning that VPNs themselves may have vulnerabilities and should be updated to the most current version available. CISA also notes that a VPN is only as secure as the devices connected through it.
CISA said no known public exploitation specifically targeting these vulnerabilities had been reported at the time of the advisory. It recommends that organizations perform an impact analysis and risk assessment before deploying defensive measures and follow established internal procedures if they observe suspected malicious activity, including reporting findings to CISA for tracking and correlation. The agency also encourages organizations to use its recommended cybersecurity strategies for proactive defense of industrial-control-system assets.