CVE-2026-73807

mySCADA myPRO Manager Missing Authorization

Critical9.3EPSS 0.78%

Published: 15 Sept 2026
Updated: 16 Sept 2026
Reserved: 8 Sept 2026
Assigned by: icscert

Description

The mySCADA myPRO Manager command API does not properly enforce authentication for privileged functions. An unauthenticated attacker with network access to the affected API could exploit this vulnerability to access privileged management functions.

Scores

CVSS scores of CVE-2026-73807, by who scored it
Scored by	CVSS	Score	Vector
icscertCNA (assigner)	4.0	Critical9.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
icscertCNA (assigner)	3.1	Critical9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVDNVD · Deferred	4.0	Critical9.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS (exploitation in 30 days): 0.78% · top 44% of all CVEs (6 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: yes · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.3.

Weakness

CWE-862 (opens in a new tab)All about CWE-862 and its CVEs

Affected products

mySCADA Technologies · mySCADA myPRO
- affected ≤ 2.1
- unaffected 2.2

What to do

Solution: mySCADA Technologies has addressed this issue in Version 2.2 and recommends that users update to the latest version. Users are notified in mySCADA Pro Manager about the availability of a new version if the device is connected to the internet. Otherwise, users can download the mySCADA Pro Manager from the webpage. https://www.myscada.org/downloads/mySCADAPROManager/

References (3)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2026-73807](https://trackcve.app/badge/CVE-2026-73807.svg)](https://trackcve.app/cve/CVE-2026-73807)

Record last updated 16 Sept 2026, 18:10 UTC.