CVE-2026-82567: Missing Authentication Allows Unauthorized SMS Transmission in mySCADA myPRO Manager

CVE-2026-82567 is an unauthenticated vulnerability in the notification gateway component of mySCADA myPRO Manager. The gateway is designed to alert an operator’s configured phone number when the SCADA system determines that an alert condition has been met. In practice, the exposed endpoint accepts a destination phone number and message body from any network-reachable caller, with no authentication or authorization check in place and forwards both directly to the connected GSM modem for transmission. 

The vulnerability was reported to CISA by SECNORA OÜ, Rajivarnan R. and Shirshak Roy, alongside a second, considerably more severe finding in the same product, CVE-2026-73807. Both vulnerabilities were disclosed together in ICS advisory ICSA-26-258-03 and remediated in the same myPRO Manager release.

What mySCADA myPRO Manager Is and Why the Notification Gateway Matters

Used across industrial environments for monitoring and control, mySCADA myPRO is a browser-based SCADA and HMI platform developed by mySCADA Technologies, with deployments reported worldwide. The advisory covering CVE-2026-82567 lists Manufacturing, Energy, Food and Agriculture, Transportation Systems and Water and Wastewater Systems as the infrastructure sectors affected.

The component, myPRO Manager handles deployment, configuration and system-level services for the platform, including a notification gateway that bridges the SCADA process to the outside world through SMS. The idea behind the gateway is simple and common in OT environments that can’t rely on constant internet connectivity for alerting: attach a GSM modem to the deployment and let the platform push a text message to an on-call engineer’s phone when a tag crosses a threshold or a device drops offline. That only works as a security boundary if the gateway checks who is allowed to trigger a message before it sends one. CVE-2026-82567 exists because that check was never implemented.

CVE-2026-82567: Vulnerability Details

  • CVE ID: CVE-2026-82567
  • Affected product: mySCADA myPRO Manager, notification gateway component
  • Affected versions: mySCADA myPRO Manager 2.1 and earlier
  • Patched version: 2.2
  • Vulnerability class: Missing Authentication for Critical Function (CWE-306)
  • CVSS v3.1 Base Score: 6.3 (MEDIUM), AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
  • CVSS v4.0 Base Score: 5.3 (MEDIUM), AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
  • Impact: Unauthorized SMS transmission through the connected GSM modem. This assessment does not identify a path from this vulnerability alone to command execution, data disclosure or control-plane compromise, though CVE-2026-73807 in the same product does provide broader access.

There is no authentication step verifying the identity of the caller and no authorization step verifying that the caller is permitted to use the SMS-sending function at all, the endpoint simply has no access control in front of it whatsoever.

How CVE-2026-82567 Works 

No authentication step verifies the caller’s identity and no authorization step checks whether the caller is permitted to trigger an SMS. The HTTP endpoint the notification gateway exposes for sending SMS accepts a destination phone number and a message body from any caller and forwards both directly to the attached GSM modem for transmission. This puts the notification gateway in an unusual position compared to most of the authentication and command-execution bugs that show up in myPRO’s advisory history.

It isn’t a flaw in how a login check is implemented or a parameter that escapes proper sanitization before hitting a shell. The access control simply does not exist on this code path, classified as CWE-306, so any request that reaches the endpoint, correctly formatted or not, is treated as authorized by default because nothing in the request-handling flow ever validates the caller.

The exact endpoint path, HTTP method and parameter names are withheld from this writeup, in line with how ICS-CERT typically handles OT advisories where publishing implementation-level detail would meaningfully lower the bar for exploitation. The confirmed functional behavior is this: a phone number and message submitted over the network are sent through the connected modem. That is the entire vulnerability surface

CVE-2026-82567: Exploitation Scenario

The advisory states that no known public exploitation targeting this vulnerability has been reported and no public proof-of-concept exploit code has surfaced as of this writing. Based on the documented behavior, the reproduction path an attacker would follow looks like this at a functional level, identify the myPRO Manager notification gateway on a reachable network segment, send a request to the SMS-triggering endpoint with an arbitrary destination number and message and confirm delivery through the connected modem. No credentials, tokens or prior interaction with the system are required at any step.

That’s a lower bar than most vulnerabilities that make it into an ICS advisory. There’s no fuzzing involved, no race condition to win and no chained precondition beyond reaching the gateway on the network. The absence of a public PoC here says more about how sensitive ICS-CERT tends to be about publishing exploit code for OT products than it does about the difficulty of triggering the bug.

What an Attacker Actually Needs

CVE-2026-82567 has exactly one real precondition: network reachability to the notification gateway. The CVSS vector rates the attack vector as Adjacent, not Network, meaning the attacker needs a position on the same segment as the gateway or a routable path to it, rather than open internet access. In a properly segmented OT network with the gateway isolated from business systems and the internet, that precondition is meaningfully hard to satisfy. In less segmented networks, which are still common in ICS environments, this precondition is considerably easier to satisfy.

Beyond that one precondition, there’s nothing else standing between an attacker and a working exploit. No credential to guess, no session to hijack, no user to trick into clicking something. That’s the practical weight of a missing authorization check: it collapses the entire attack chain down to a single step.

Remediation

A fix for CVE-2026-82567 is available in myPRO Manager version 2.2. The following steps outline the recommended remediation path:

  • Upgrade to myPRO Manager 2.2 or later. This is the vendor-supplied fix and the primary remediation path. The same release also resolves CVE-2026-73807, the missing-authorization flaw in the myPRO Manager command API disclosed in the same advisory.
  • If the device is connected to the internet, myPRO Manager notifies users in-app when a new version is available. Where a device is not internet-connected, operators can download the update directly from mySCADA’s official downloads page.
  • Where immediate patching isn’t feasible, apply network-layer segmentation around the notification gateway as a compensating control. Since the CVSS vector rates the attack path as Adjacent rather than Network, restricting which hosts can reach the gateway meaningfully narrows the exploitable population even before the update is deployed.
  • Keep ICS management interfaces, including notification gateways, off business networks and off the internet entirely. This is standard defense-in-depth guidance for OT assets generally and it applies directly here.
  • Where remote access to the gateway or adjacent infrastructure is genuinely required, route it through a properly maintained VPN rather than exposing the interface directly, keeping in mind that a VPN is only as secure as the devices connected through it.
  • As an additional compensating control, monitor for anomalous or unexpected SMS-triggering traffic to the gateway, where network visibility permits, while the update is scheduled.

Applying the vendor patch remains the primary remediation, the remaining steps serve as compensating controls where immediate patching is not feasible.

Conclusion

CVE-2026-82567 highlights a broader pattern: an outward-facing feature that every downstream system trusted by default, with no control over who could use it. This is a different failure mode from the command-injection and hardcoded-credential issues that have historically appeared in myPRO advisories and it should be treated as a distinct issue rather than a footnote to those.

Organizations running mySCADA myPRO Manager should confirm their current version, apply the 2.2 update and ensure the notification gateway receives the same level of network segmentation as other OT management interfaces, rather than being treated as a lower-risk component simply because its function is limited to sending alerts.

SECNORA helps organisations strengthen application security through expert-led penetration testing that identifies vulnerabilities before they reach production. Talk to our team. 

References