The distinction between the two bugs is important for Windows administrators. mySCADA’s own documentation describes myPRO Manager as the tool used to manage runtime versions, licensing, service monitoring, HTTP/HTTPS settings, users, two-factor authentication and USB-modem notifications. In other words, this is not an isolated operator-facing dashboard; it is a management plane for a SCADA deployment. mySCADA documents Windows 11 and Windows Server 2022 among the supported platforms for myPRO, while describing the Manager itself as available for Windows and Linux.
CISA says mySCADA Technologies fixed both issues in mySCADA myPRO Manager 2.2, which the vendor announced on September 7 as a stability and security release. The timing leaves a short but meaningful exposure window for sites that installed or retained the older Manager releases and have not yet accepted the in-product update.
CVE-2026-73807 exposes the management plane
The more serious issue, CVE-2026-73807, is an authorization failure in the myPRO Manager command API. According to CISA, privileged API functions do not properly enforce authentication, allowing an unauthenticated attacker with network access to access management functions on an affected installation.
CISA assigns the vulnerability a CVSS 3.1 score of 9.8, with a vector that requires no credentials, no user interaction, and only network reachability. The advisory rates confidentiality, integrity and availability consequences as high. That rating is warranted by the position of the affected component: myPRO Manager can change runtime versions and settings, manage administrative users, control remote-access-related configuration, and handle service operations.
The immediate operational risk is larger than an ordinary web-console login bypass. A compromised management function may give an intruder a route to alter how the SCADA runtime is delivered or maintained, change settings intended to constrain access, or disrupt the management workflow that operators depend upon during an incident. CISA does not publish a list of individual API commands exposed by the flaw, so administrators should not assume that a visible login page proves the Manager’s supporting API is protected.
That missing technical detail is also why network segmentation remains necessary after patching. Version 2.2 addresses the reported defects, but a management service for industrial runtime software should not be broadly reachable from office networks, guest Wi-Fi, contractor VLANs, or any internet-facing address. A patch closes this vulnerability; it does not turn a flat industrial network into a defensible architecture.
CVE-2026-82567 can turn alarm hardware into an SMS relay
The second flaw, CVE-2026-82567, sits in the notification gateway used with a connected GSM modem. CISA says the gateway exposes an unauthenticated HTTP endpoint that accepts a telephone number and message, then sends the requested SMS through the modem. An attacker with access to that endpoint could therefore send messages using the SIM card and cellular hardware already attached to the industrial host.
mySCADA’s product documentation confirms that Manager configurations can define a USB modem port and enable modem-based notifications. Its settings documentation directs Windows users to identify the modem’s AT port through Device Manager. This is a real feature path, rather than a theoretical subsystem that most deployments would never enable.
CISA scores this issue at 6.3 under CVSS 3.1 and 5.3 under CVSS 4.0, both materially lower than the management API defect. The difference comes down to reachability and impact: the CVSS 3.1 vector treats the attack as adjacent-network rather than broadly network-reachable, and assigns lower confidentiality, integrity, and availability effects. Still, “medium” should not be read as harmless in a control environment.
An unauthorized SMS relay can create costs, trigger carrier fraud controls, and make alerting untrustworthy at the moment it is most needed. If operators rely on SMS to notify an on-call engineer about a stopped line, water-system alarm, transport fault, or energy event, an attacker could create noise, impersonate a facility’s established alert channel, or exhaust a modem or SIM plan with unsolicited traffic. CISA’s advisory does not say the endpoint can read inbound messages, access contacts, or control the modem beyond sending SMS; those outcomes should not be assumed. The demonstrated concern is arbitrary outbound messaging.
The pairing of these bugs is the practical problem. One issue targets the Manager’s privileged controls, while the other abuses the notification path. They should be treated as separate remediation items during validation, especially where a site has deployed the Manager without a GSM modem and may conclude it is unaffected by the full advisory. Every Manager version through 2.1 is affected by the management API issue; the modem-specific exposure becomes relevant where the notification gateway and connected GSM hardware are in use.
Version 2.2 is the fix, but an update prompt is not an asset inventory
CISA lists mySCADA myPRO Manager versions 2.1 and earlier as affected and identifies version 2.2 as the vendor’s remediation. mySCADA says Manager users connected to the internet are notified of new versions, with an offline download path for disconnected deployments. That convenience has a limitation common in operational technology: systems deliberately isolated from the internet are also the least likely to advertise their own patch status.
Administrators should therefore verify the installed Manager version directly rather than relying on whether an update notification appeared. That check should include engineering workstations, management servers, test benches, integrator laptops, standby industrial PCs, and any gold image used to provision replacement systems. A forgotten 2.1 installer in an engineering share or device image can reintroduce the vulnerable component after the production environment has been upgraded.
The vendor’s public material creates another reason to take a deliberate approach. myPRO can run in Windows environments, and mySCADA describes its newer runtime design as using Windows Subsystem for Linux on Windows systems. The management tool may therefore sit alongside Windows services and industrial workloads whose maintenance windows are constrained. Updating the Manager should be scheduled as a production change, but it should not be deferred simply because a plant’s runtime is otherwise stable.
Before deploying version 2.2 widely, preserve the Manager configuration and record the existing ports, user roles, two-factor authentication settings, runtime version, licensing state, remote-access configuration, and modem settings. mySCADA documents backup and restore capabilities for Manager configuration; use them, but also retain an independent change record. A backup only helps if the recovery process has been tested and the organization can distinguish a known-good pre-change configuration from one that already contained insecure exposure.
What Windows and OT teams should do now
CISA says it has received no reports of public exploitation specifically targeting either vulnerability as of September 15. That is useful situational information, not grounds to wait: both issues require no attacker credentials, and the critical API flaw requires only network reachability. The absence of a reported exploit is particularly weak protection for assets that are difficult to inventory and rarely monitored at the application layer.
A proportionate response should combine the vendor update with an exposure review:
- Upgrade every mySCADA myPRO Manager installation at version 2.1 or earlier to version 2.2, following the site’s change-control process and validating normal runtime management after installation.
- Restrict access to Manager interfaces and related API endpoints with host firewalls and network controls so that only specifically authorized administrative systems can reach them.
- Remove direct internet exposure from control-system devices and management hosts. CISA specifically recommends placing control networks and remote devices behind firewalls and isolating them from business networks.
- Require controlled remote access, such as a maintained VPN with tightly scoped user access, instead of publishing Manager services through port forwarding or a perimeter firewall rule.
- Identify systems with configured USB or integrated GSM modems, then review outbound SMS logs, SIM usage, and carrier billing for unexpected messages while the upgrade is underway.
- Test that version 2.2 preserves configured authentication, roles, certificates, runtime ports, alerting behavior, and modem communications before closing the maintenance ticket.
There is a subtle asset-management issue here. A site might inventory the myPRO runtime but omit myPRO Manager because it appears to be a local administrative utility. CISA’s advisory shows why that classification is unsafe. The Manager has network-exposed functions, controls security-relevant settings, and can interface with a physical SMS-capable modem. It belongs in the same vulnerability-management and network-exposure process as the runtime it administers.
The patch priority is clear
CVE-2026-73807 deserves urgent attention wherever myPRO Manager can be reached by another system. The high score is not merely an abstract severity label: CISA describes an unauthenticated route to privileged management functions in software designed to administer industrial SCADA operations. Sites with the Manager on a broadly accessible Windows workstation or server should treat that placement as an exposure problem even before they complete the upgrade.
CVE-2026-82567 is narrower but can undermine trusted alerting and consume a facility’s cellular messaging capability. Any operation that depends on the connected modem to wake responders should validate both its access controls and its outbound-message history.
The concrete milestone is version 2.2. Once it is installed and the management interface is confined to the systems that genuinely need it, the two reported paths—unauthenticated privileged API access and unauthenticated SMS submission—are no longer reasons for an attacker on the reachable network to treat a myPRO Manager host as an easy entry point.