CVE-2026-73807 is a missing-authorization flaw in mySCADA Technologies' myPRO Manager: its command API does not enforce authentication for privileged functions, letting an unauthenticated network attacker reach privileged management operations; NVD has not, as of 2026-10-27, completed its own CVSS scoring or CPE mapping.
Vulnerability summary
CVSS base score
N/A
No NVD score published as of
EPSS score (FIRST)
0.8%
Probability of exploitation in the wild in the next 30 days
CISA KEV catalog
No
Not listed
Published
Vulnerability ID: CVE-2026-73807 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| mySCADA myPRO Manager | — | 0 through 2.1 (fixed in 2.2), per CISA ICS Advisory ICSA-26-258-03; no published NVD CPE applicability statement |
What does this mean for affected devices?
CVE-2026-73807 is a missing authorization vulnerability (CWE-862) in mySCADA Technologies' myPRO Manager, a supervisory control and data acquisition (SCADA) management tool. NVD's description states: "The mySCADA myPRO Manager command API does not properly enforce authentication for privileged functions. An unauthenticated attacker with network access to the affected API could exploit this vulnerability to access privileged management functions" (NVD).
NVD tracks the CVE with status "Deferred" as of 2026-10-27: it records a CNA-submitted (ICS-CERT) CVSS v3.1 score of 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, and a CVSS v4.0 score of 9.3 (critical), but NVD has not published its own independent score or a CPE applicability statement, so this page does not show a headline severity score rather than presenting the CNA figure as NVD-confirmed (NVD).
CISA's advisory ICSA-26-258-03, published 2026-09-15, confirms myPRO Manager versions 0 through 2.1 are affected and fixed in version 2.2. The same advisory discloses a second, related flaw in the same product — CVE-2026-82567, an unauthenticated notification-gateway endpoint that lets an attacker "send arbitrary SMS messages through the connected modem" (CVSS v3.1 6.3) — and its remediation points operators to the mySCADA download page for the 2.2 update (CISA ICS Advisory ICSA-26-258-03).
This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of 2026-10-27, and FIRST scores the probability of exploitation at 0.00778 (55.6th percentile) as of 2026-10-26 (CISA KEV, FIRST EPSS).
NVD has not finished its own severity and applicability analysis. In the meantime, myPRO Manager operators should update to version 2.2 and keep the management API and SMS/notification gateway off any network that is not already segmented and firewalled, given the second unauthenticated flaw disclosed in the same advisory.
Evidence
- myPRO Manager's command API does not enforce authentication for privileged functions, letting an unauthenticated network attacker reach privileged management operations (CWE-862). — NVD
- NVD status is "Deferred" with a CNA (ICS-CERT) submitted CVSS v3.1 9.8 / v4.0 9.3, no NVD-published score or CPE configuration as of 2026-10-27. — NVD
- Affects myPRO Manager 0 through 2.1, fixed in 2.2; disclosed alongside related CVE-2026-82567 (unauthenticated SMS-send via notification gateway, 6.3) in the same ICSA-26-258-03 advisory. — CISA ICS Advisory ICSA-26-258-03
- Not present in the CISA KEV catalog as of 2026-10-27. — CISA KEV
- EPSS score is 0.00778 (55.6th percentile) as of 2026-10-26. — FIRST EPSS
Related advisories
Sources
Frequently asked questions
What is CVE-2026-73807?
CVE-2026-73807 is a missing-authorization flaw in mySCADA Technologies' myPRO Manager: its command API does not enforce authentication for privileged functions, letting an unauthenticated network attacker reach privileged management operations; NVD has not, as of 2026-10-27, completed its own CVSS scoring or CPE mapping.
How severe is CVE-2026-73807?
CVE-2026-73807 has no NVD CVSS score published as of 2026-11-10, so this page gives it no severity rating rather than assuming low or high risk.
Is CVE-2026-73807 being actively exploited?
CVE-2026-73807 is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. FIRST's EPSS model puts its probability of exploitation at 0.78%.
What is affected by CVE-2026-73807?
CVE-2026-73807 affects mySCADA myPRO Manager.
Where does this CVE-2026-73807 information come from?
This advisory is based on NVD, CISA ICS Advisory ICSA-26-258-03, CISA KEV, and FIRST EPSS, cited in full in the Sources section above.
Questions about this page?