Source: cisa.gov
CISA has issued an advisory for mySCADA myPRO Manager versions 2.1 and below, identifying two critical vulnerabilities. CVE-2026-73807 (CVSS 9.8 Critical) involves missing authorization in the command API, allowing unauthenticated attackers to access privileged management functions. CVE-2026-82567 (CVSS 6.3 Medium) exposes an unauthenticated HTTP endpoint enabling arbitrary SMS messages to be sent via a connected GSM modem. Both vulnerabilities require no authentication and are remotely exploitable. Affected sectors include Critical Manufacturing, Energy, Food and Agriculture, Transportation, and Water/Wastewater systems deployed worldwide. The vendor mySCADA Technologies has released version 2.2 as a fix. No known public exploitation has been reported. Shirshak Secnora OÜ reported these vulnerabilities to CISA.
