CISA Warns of Critical mySCADA Flaw Exposing Industrial Controls

CISA has disclosed two vulnerabilities in mySCADA myPRO Manager, affecting installations running version 2.1 and earlier. CVE-2026-73807 is rated critical, with a CVSS v3 score of 9.8, while CVE-2026-82567 has a score of 6.3. Both are classified as missing-authorisation flaws and could expose privileged functions in industrial control environments used across manufacturing, energy, water and transport.

CVE-2026-73807 affects the command API, which does not properly enforce authentication for privileged functions. An attacker with network access could therefore reach restricted management capabilities without credentials. CVE-2026-82567 affects the notification gateway, which exposes an unauthenticated HTTP endpoint for sending SMS messages through a connected GSM modem. CISA said there is currently no confirmed exploitation or public proof of concept for either vulnerability.

mySCADA Technologies has addressed both issues in version 2.2. Administrators should upgrade affected systems to that release. Where updates cannot be applied immediately, the article recommends isolating control-system networks behind firewalls.