CVE-2026-73807: Critical Missing Authorization Flaw in mySCADA myPRO Manager

CVE-2026-73807 is a critical missing authorization vulnerability in mySCADA myPRO Manager, an industrial control system (ICS) management platform used across critical infrastructure sectors worldwide. The flaw sits in the product’s command API, which fails to properly enforce authentication before granting access to privileged management functions. With a CVSS v3.1 base score of 9.8 and a v4.0 score of 9.3, both rated Critical, CVE-2026-73807 allows an unauthenticated attacker with network access to the affected API to reach administrative-level functionality on the device, without needing valid credentials, user interaction or prior access.

The vulnerability was published under ICS advisory ICSA-26-258-03, alongside a second finding, CVE-2026-82567 in the same product. This post breaks down the technical details of CVE-2026-73807, the affected deployment scope and the remediation guidance issued by mySCADA Technologies. CVE-2026-73807 was reported to CISA by SECNORA OÜ, Rajivarnan R. and Shirshak Roy.

What Is CVE-2026-73807?

CVE-2026-73807 affects mySCADA myPRO Manager versions 2.1 and earlier. Per the advisory, the product’s command API does not properly enforce authentication for functions that should be restricted to privileged users. Because the API is reachable over the network, any party who can route traffic to it can invoke management-level operations that are normally gated behind an authenticated session.

This is classified under CWE-862, Missing Authorization. In practical terms, the application distinguishes between regular and privileged operations in its design, but the enforcement layer that is supposed to check a caller’s identity and permissions before executing a privileged command is either absent or bypassable on this API path.

Vulnerability Details

The advisory documents the following technical metrics for CVE-2026-73807:

  • Affected Product: mySCADA myPRO Manager, versions <=2.1
  • Weakness type: CWE-862, Missing Authorization
  • CVSS v3.1 base score: 9.8 (Critical) 
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  • CVSS v4.0 base score: 9.3 (Critical) 
  • Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Reading the vector string, the attack is network-based (AV:N), requires low attack complexity (AC:L), needs no privileges (PR:N) and no user interaction (UI:N). The impact spans confidentiality, integrity and availability, all rated High. This combination is what pushes CVE-2026-73807 into the critical band, an attacker does not need to be on the same network segment as an operator, does not need social engineering and does not need a foothold on any other system first. Network reachability to the exposed API is the only real prerequisite.

Technical Root Cause

The underlying issue with CVE-2026-73807 is an authorization gap rather than a cryptographic or memory-safety bug. The command API on mySCADA myPRO Manager appears to expose privileged management endpoints without verifying that the requesting party has the rights to invoke them. This is a common failure mode in ICS and SCADA management software, where engineering interfaces are often built assuming a trusted network perimeter rather than a zero-trust posture. When that assumption breaks, for example when the device is reachable from a corporate network, a remote-access VPN or the internet, the missing authorization check becomes directly exploitable.

A Related Finding in the Same Advisory: CVE-2026-82567

The same ICSA-26-258-03 advisory also documents CVE-2026-82567, a Missing Authentication for Critical Function issue (CWE-306) in the myPRO Manager notification gateway. That endpoint accepts a phone number and message over the network without authentication and forwards it to a connected GSM modem to send SMS messages. It carries a lower CVSS v3.1 score of 6.3 (Medium). While CVE-2026-82567 is not the focus of this post, it reinforces a pattern in this release: multiple network-facing endpoints in mySCADA myPRO Manager <=2.1 lacked adequate access control and organizations patching for CVE-2026-73807 should apply the same update to close both issues at once.

Exploitation Status

To date, no known public exploitation specifically targeting CVE-2026-73807 has been reported. This should not be read as an indicator of low risk. The vulnerability requires no authentication, no user interaction and only network access to the affected API, which is a profile that historically sees rapid scanning and exploitation attempts once details become public, particularly for internet-facing ICS management interfaces.

Remediation and Mitigation

mySCADA Technologies has addressed CVE-2026-73807 in mySCADA myPRO Manager Version 2.2. Organizations running an affected version should update as their first priority. Devices connected to the internet may receive an in-application notification about the new version; otherwise, the update can be downloaded directly from mySCADA’s official download page.

Where immediate patching is not possible, the advisory’s standard ICS recommended practices apply directly to CVE-2026-73807:

  • Minimize network exposure for all control system devices and ensure the myPRO Manager command API is not reachable from the internet.
  • Locate control system networks and remote devices behind firewalls and isolate them from business IT networks.
  • Where remote access is required, use secure methods such as VPNs, while recognizing that a VPN is only as secure as the devices connected through it and should itself be kept current.
  • Perform a proper impact analysis and risk assessment before deploying any compensating controls.

Conclusion

CVE-2026-73807 is a reminder that authorization logic in ICS management software deserves the same scrutiny as authentication logic. A 9.8 CVSS score on a management-tier product that oversees infrastructure across five critical sectors is a meaningful data point for any risk register, independent of whether active exploitation has been observed yet. Security teams operating mySCADA myPRO Manager should treat this advisory as an action item: confirm the deployed version, apply Version 2.2 and validate that the command API is not exposed beyond the segments and personnel that genuinely need access to it.

SECNORA helps organizations identify critical vulnerabilities in ICS, OT and enterprise environments through expert-led security research and penetration testing, before attackers find them first. Talk to our team.

References