CVE-2026-73807

The mySCADA myPRO Manager command API fails to enforce authentication on privileged functions (CWE-862, missing authorization), allowing any unauthenticated attacker with network access to the API to invoke those functions directly. Exploitation requires no credentials, privileges, or user interaction (CVSS v4.0 9.3, critical, network attack vector), making it a simple crafted-request attack against any reachable instance. A successful attacker gains access to privileged management functions of the Manager component, which could be leveraged to manipulate the myPRO HMI/SCADA environment it administers. Affected users are industrial organizations running mySCADA myPRO Manager with the command API reachable from untrusted networks; the advisory data does not specify affected version ranges. No public PoC is known, the CVE is not on CISA's KEV list, and there is no evidence of exploitation in the wild.

What to do: Restrict network access to the myPRO Manager command API so it is reachable only from trusted management hosts via firewall rules, VPN, or OT network segmentation — it should never be internet-facing. Check the ICS-CERT and mySCADA advisories for a fixed release and upgrade Manager as soon as one is available. Review Manager logs for unauthenticated or unexpected API calls that could indicate probing or attempted exploitation.