CVE-2026-73807 & CVE-2026-82567: mySCADA myPRO Manager Critical Auth Bypass — Detection and Remediation Guide

CISA has published ICS Advisory ICSA-26-258-03 covering two critical vulnerabilities in mySCADA myPRO Manager, a SCADA/HMI management platform deployed worldwide across Critical Manufacturing, Energy, Food and Agriculture, Transportation Systems, and Water and Wastewater sectors. Both flaws — CVE-2026-73807 (Missing Authentication for Critical Function) and CVE-2026-82567 (Missing Authorization) — carry a CVSS v3 score of 9.8 (Critical).

The impact statement from CISA is blunt: successful exploitation could allow an attacker to access privileged management functions or send arbitrary SMS messages through a connected GSM modem. In plain terms — an unauthenticated remote attacker can take administrative control of the system that manages your HMI/SCADA projects, and can weaponize your own GSM modem for SMS flooding, smishing campaigns, or out-of-band C2. For organizations running myPRO Manager version 2.1 or earlier, this is a patch-and-isolate event, not a monitor-and-wait event.

Technical Analysis

Affected Products

• Product: mySCADA myPRO Manager
• Affected versions: 2.1 and earlier
• Vendor: mySCADA Technologies (headquartered in Czechia)
• Deployment: Worldwide, across five critical infrastructure sectors

The Vulnerabilities

CVE-2026-73807 strikes at the myPRO Manager command API. The API fails to enforce authentication on critical functions, meaning any attacker who can reach the management interface over the network can invoke privileged operations without credentials. No session token, no login — direct access to management functionality.

CVE-2026-82567 compounds the problem: even where some access control exists, authorization checks are missing, allowing a low-privileged or unauthenticated requester to invoke functions that should require administrative rights — including, per CISA, the ability to send arbitrary SMS messages through a connected GSM modem.

Why This Matters in OT

From a defender's perspective, three things make this advisory particularly dangerous:

1. The attack surface is the management plane, not just an HMI screen. myPRO Manager handles project deployment, user management, and device communication. Compromise here is a pivot point into the entire SCADA environment — project files, connected PLCs/RTUs, and historian integrations.
2. Exploitation requires no authentication and no user interaction. A CVSS 9.8 with missing authentication means the barrier to entry is network reachability alone. Any myPRO Manager instance exposed to a flat IT/OT network — or worse, the internet — is trivially exploitable.
3. The GSM modem angle is an underappreciated exfiltration and abuse channel. Arbitrary SMS sending enables toll fraud, smishing using a trusted industrial sender identity, and a covert out-of-band signaling channel that bypasses your network monitoring entirely.

Exploitation Status

At the time of this writing, CISA has not reported confirmed in-the-wild exploitation, and neither CVE has been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the vulnerability class — missing authentication on a management API — is the exact pattern that ransomware affiliates and OT-focused intrusion sets operationalize within days of disclosure. Do not interpret the absence of KEV listing as absence of risk. Shodan-indexed mySCADA interfaces have historically been discoverable; assume scanning is already underway.

Detection & Response

Because myPRO Manager is a server application (Windows or Linux) with a web-based management interface, detection centers on three observables: unauthenticated requests to the command API, anomalous SMS/GSM modem activity, and network exposure of the management interface itself.

Sigma Rules

---
title: Unauthenticated Access Attempt to mySCADA myPRO Manager Command API
id: 3f7a9c21-8b4d-4e62-a91f-5c2d8e6b1a47
status: experimental
description: Detects HTTP requests to mySCADA myPRO Manager command API endpoints, which per CVE-2026-73807 do not enforce authentication on critical functions. Any request matching these patterns from non-engineering-workstation sources should be investigated.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-258-03
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
detection:
  selection:
    cs-uri-stem|contains:
      - '/api/'
      - '/command'
      - '/manager/'
    sc-status:
      - 200
      - 201
      - 204
  filter_known_hosts:
    cs-user-agent|contains:
      - 'myPRO'
  condition: selection and not filter_known_hosts
falsepositives:
  - Legitimate myPRO client sessions from engineering workstations
  - Vendor maintenance activity
level: high
---
title: Suspicious SMS/GSM Function Invocation on mySCADA myPRO Manager
id: 9e1b5d83-2f6a-4c78-b345-7d9f2a4e8c16
status: experimental
description: Detects web requests targeting SMS or GSM modem functionality on mySCADA myPRO Manager. CVE-2026-82567 allows missing-authorization access to send arbitrary SMS via a connected GSM modem. High-fidelity in environments where SMS alerting is unused or rare.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-258-03
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.impact
  - attack.exfiltration
logsource:
  category: webserver
detection:
  selection:
    cs-uri-stem|contains:
      - 'sms'
      - 'gsm'
      - 'modem'
      - 'sendMessage'
  condition: selection
falsepositives:
  - Legitimate alarm-notification SMS configured by OT administrators
level: critical

Tuning guidance: Baseline which source IPs legitimately manage myPRO (engineering workstations, jump hosts) and alert on everything else. In a properly segmented OT environment, the set of legitimate sources should be very small — which makes these rules high-fidelity.

KQL — Microsoft Sentinel (via CEF/Syslog or WAF/Proxy ingestion)

// Hunt for inbound requests to mySCADA myPRO Manager management/API endpoints
// Ingested via firewall, reverse proxy, or web server logs
let mypro_ports = dynamic([8080, 8090, 443, 80]);
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where DestinationPort in (mypro_ports)
| where RequestURL has_any ("/api/", "/command", "/manager/", "sms", "gsm", "modem", "sendMessage")
    or RequestClientApplication has "myPRO"
| summarize RequestCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
    by SourceIP, DestinationIP, DestinationPort, RequestURL, RequestMethod
| order by RequestCount desc
// Correlate with new outbound SMS/modem signaling and any source IPs not on the engineering allowlist

// Identify network exposure: who is talking to the myPRO Manager host at all?
// Use your asset inventory to plug in the myPRO server IP(s)
let MyProHosts = dynamic(["10.10.20.15", "192.168.50.20"]); // REPLACE with your myPRO Manager IPs
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where RemoteIP in (MyProHosts) or LocalIP in (MyProHosts)
| where RemotePort in (8080, 8090) or LocalPort in (8080, 8090)
| summarize Connections = count(), DistinctSources = dcount(RemoteIP)
    by LocalIP, LocalPort, RemoteIP, RemotePort, InitiatingProcessName
| order by DistinctSources desc

Velociraptor VQL — Hunt the myPRO Host Directly

-- Hunt for unexpected network listeners and connections on mySCADA myPRO Manager hosts
-- Look for the management service listening on 0.0.0.0 (exposed) vs. 127.0.0.1 (local-only)
SELECT Pid, Name, Path, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status
FROM netstat()
WHERE (LocalPort in (8080, 8090, 443)
   OR Path =~ '(?i)mypro|myscada')
   AND Status =~ 'LISTEN|ESTABLISHED'

-- Enumerate myPRO installation to determine version for exposure assessment
SELECT FullPath, Size, Mtime
FROM glob(globs=['C:/Program Files*/mySCADA/**', 'C:/myPRO/**', '/opt/myscada/**', '/opt/mypro/**'])
WHERE NOT IsDir
ORDER BY Mtime DESC
LIMIT 50

Verification & Hardening Script

Run this on Windows hosts running myPRO Manager to determine version exposure and lock down the management interface to localhost or a management VLAN while awaiting patching:

# mySCADA myPRO Manager exposure check and interim hardening
# Run elevated on the myPRO Manager host

# 1. Identify installed myPRO version
$mypro = Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* ,
    HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* -ErrorAction SilentlyContinue |
    Where-Object { $_.DisplayName -match 'myPRO|mySCADA' } |
    Select-Object DisplayName, DisplayVersion
$mypro | Format-Table -AutoSize
foreach ($app in $mypro) {
    if ($app.DisplayVersion -and ([version]$app.DisplayVersion -le [version]'2.1')) {
        Write-Warning "VULNERABLE: $($app.DisplayName) $($app.DisplayVersion) <= 2.1 (CVE-2026-73807 / CVE-2026-82567)"
    }
}

# 2. Check if management ports are exposed on all interfaces
Get-NetTCPConnection -State Listen -ErrorAction SilentlyContinue |
    Where-Object { $_.LocalPort -in 8080,8090 } |
    Select-Object LocalAddress, LocalPort, OwningProcess |
    Format-Table -AutoSize

# 3. Interim mitigation: restrict management ports to an approved admin subnet only
$AdminSubnet = '192.168.10.0/24'  # REPLACE with your OT management/jump-host subnet
foreach ($port in 8080,8090) {
    New-NetFirewallRule -DisplayName "myPRO-Mgmt-Allow-Admin-$port" `
        -Direction Inbound -Protocol TCP -LocalPort $port `
        -RemoteAddress $AdminSubnet -Action Allow -ErrorAction SilentlyContinue
    New-NetFirewallRule -DisplayName "myPRO-Mgmt-Block-All-$port" `
        -Direction Inbound -Protocol TCP -LocalPort $port `
        -Action Block -ErrorAction SilentlyContinue
}
Write-Host "Interim firewall restrictions applied. Upgrade to the patched myPRO version immediately."

For Linux-hosted instances, verify exposure and restrict with iptables/nftables to your management subnet, and confirm whether a GSM modem is physically attached (lsusb, mmcli -L for ModemManager environments).

Remediation

1. Upgrade immediately. CISA and mySCADA confirm versions 2.1 and earlier are affected. Contact mySCADA Technologies or your integrator and obtain the current patched release of myPRO Manager. Do not wait for a maintenance window to at least schedule this — a 9.8 missing-auth flaw on a management plane is emergency-change territory.
2. Remove network reachability as a compensating control today. The exploitation prerequisite is network access. Ensure myPRO Manager is reachable only from a dedicated OT management VLAN/jump host. Confirm it is not internet-facing — check Shodan/Censys for your public ranges and audit firewall/NAT rules.
3. Disable or disconnect the GSM modem if SMS alerting is not operationally required. CVE-2026-82567's arbitrary-SMS capability is only exploitable if the modem is attached. Where SMS alerting is required, monitor modem activity (carrier billing anomalies, unexpected outbound messages) as a detection signal.
4. Enforce defense-in-depth per CISA ICS guidance:
   • Place all control system devices behind firewalls and isolate them from business networks.
   • Require VPN with MFA for any remote access into the OT zone, and treat the VPN concentrator as a separately managed, patched asset.
   • Apply the principle of least privilege to any accounts that interact with myPRO Manager.
5. Validate after patching: re-run the verification script above, confirm the management API now rejects unauthenticated requests (test with curl/browser in an incognito session from a non-allowlisted host), and confirm the version no longer falls in the <=2.1 range.
6. Report suspected exploitation to CISA (central@cisa.gov or the CISA ICS reporting portal) and preserve web/proxy/firewall logs covering the management interface for forensic review.

References:

• CISA ICS Advisory ICSA-26-258-03: https://www.cisa.gov/news-events/ics-advisories/icsa-26-258-03
• mySCADA Technologies: https://www.myscada.org
• CISA ICS Recommended Practices: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

Related Resources

Security Arsenal Managed SOC Services AlertMonitor Platform Book a SOC Assessment soc-mdr Intel Hub