by Kastro
Paper/Archive/CVE-2026-73807

CVE-2026-73807

mySCADA Technologies mySCADA myPRO — mySCADA myPRO Manager Missing Authorization

EPSS 0.8%CVSS 9.8
critical.is priorityof 100
41
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 55.9.559 × 2011.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The mySCADA myPRO Manager command API does not properly enforce authentication for privileged functions. An unauthenticated attacker with network access to the affected API could exploit this vulnerability to access privileged management functions.

Affected

ProductAffectedFixed inSource
mySCADA myPRO≤ 2.12.2CNA

Scores by source

icscert (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
icscert (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refmyscada.org/downloads/mySCADAPROManagerrefcisa.gov/news-events/ics-advisories/icsa-26-258-03refgithub.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-258-03.json