CISA Advises Critical Patches for mySCADA myPRO Manager Vulnerabilities

The Cybersecurity and Infrastructure Security Agency (CISA) published advisory ICSA-26-258-03 on September 15, 2026, disclosing two vulnerabilities in mySCADA myPRO Manager, a supervisory control and data acquisition (SCADA) platform used across critical infrastructure sectors. The product is developed by mySCADA Technologies, headquartered in Czechia, and is deployed worldwide in sectors including Critical Manufacturing, Energy, Food and Agriculture, Transportation Systems, and Water and Wastewater.

The first vulnerability, CVE-2026-73807, carries a CVSS v3.1 base score of 9.8 (CRITICAL). It stems from a missing authorization flaw in the command API, which does not properly enforce authentication for privileged functions. An unauthenticated attacker with network access to the affected API could exploit this to access privileged management functions.

The second vulnerability, CVE-2026-82567, has a CVSS v3.1 base score of 6.3 (MEDIUM). It involves an unauthenticated HTTP endpoint in the notification gateway that accepts requests to send SMS messages through a connected GSM modem. An unauthenticated attacker with network access could exploit this to send arbitrary SMS messages through the modem.

mySCADA Technologies has addressed these issues in Version 2.2. The vendor recommends that users update to the latest version. Users connected to the internet will be notified about the availability of a new version within the application; otherwise, the update can be manually downloaded from the official webpage at https://www.myscada.org/downloads/mySCADAPROManager/.

CISA recommends that organizations minimize network exposure for all control system devices, ensuring they are not accessible from the internet. Devices should be located behind firewalls and isolated from business networks. When remote access is required, the use of virtual private networks (VPNs) is advised, with the recognition that VPN security is only as strong as the connected devices. CISA also encourages organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.