mySCADA's myPRO Manager is the software that sits above industrial control systems and manages them, and up to version 2.1 its command API does not properly check who is calling. CISA published the advisory on September 15 and scored the flaw 9.8 out of 10. An unauthenticated attacker who can reach the API can reach privileged management functions with it.
A management API with no lock
The flaw, CVE-2026-73807, is a missing authorization problem rather than a memory corruption bug, which in practice makes it easier to exploit, not harder. There is no crash to engineer and no payload to tune, because the request simply works. CISA's vector assumes a network-reachable attacker with no privileges and no user interaction, which is why the CVSS 3.1 score lands at 9.8 critical, with CVSS 4.0 putting it at 9.3.
What makes it matter is where this software runs. CISA lists the affected sectors as critical manufacturing, energy, food and agriculture, transportation systems, and water and wastewater. Management layers are attractive to an attacker precisely because they are built to reach many devices at once, so a flaw in the manager inherits the reach of everything it manages. mySCADA Technologies is based in Czechia and the product is deployed worldwide. Shirshak Secnora OÜ reported both issues to CISA.
The modem that texts for strangers
The second flaw is smaller and more peculiar. myPRO Manager's notification gateway, the part that sends operators their alerts, exposes an HTTP endpoint that accepts a phone number and a message and passes them to a connected GSM modem, without asking the caller to authenticate first. Anyone who can reach that endpoint can send arbitrary text messages through somebody else's modem.
CISA scores this one 6.3 medium, and its vector limits the attacker to the adjacent network rather than the open internet, so it is not the headline. It is still worth closing. A messaging channel that belongs to a utility is a useful thing for a fraudster to borrow, and alerting infrastructure is a natural thing to want control of while doing something else. It is tracked as CVE-2026-82567.
Update to 2.2, then check exposure
mySCADA Technologies has fixed both issues in version 2.2 and recommends updating. Installations connected to the internet are notified inside myPRO Manager when a new version is available, and everyone else can download it from the mySCADA site. Anything on 2.1 or earlier is affected.
The patch is the fix, but the exposure question deserves its own answer, because a management API that was never meant to face the internet is the kind of thing that quietly ends up facing it. Water utilities have already been caught this way, as the internet-facing PLCs that attackers locked operators out of showed, and the pattern repeats across industrial gateways, including the Haiwell flaw that handed over root. CISA reports no known public exploitation of either mySCADA flaw at this time, and its standing advice applies: keep control system networks off the internet and behind a firewall, segmented from business systems.
CISA's full advisory is published as ICSA-26-258-03.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.