CVE-2026-73807
CRITICAL · 9.8Real CVSS 9.8 vuln, patch available, but no confirmed in-the-wild exploitation or KEV listing yet.
What: mySCADA myPRO Manager command API lacks authentication enforcement for privileged functions, allowing unauthenticated network access to management controls (CVSS 9.8 CRITICAL).
Why it matters: High CVSS score and critical authentication bypass in industrial control software affecting versions 0–2.1. Social chatter mentions patch availability (v2.2), suggesting vendor urgency. Not yet KEV-listed but widespread awareness across security platforms and threat intel feeds signals real concern.
Where it's seen: Aggregator posts (stemshop, offseq, radar) amplifying the NVD entry; threat intel platforms cross-referencing related CVE; vendor patching guidance circulating. Minimal technical PoC chatter, mostly advisory echoing.
RISK: CRITICAL — Unauthenticated remote API access to privileged ICS management functions; v2.1 and below affected.
Description
The mySCADA myPRO Manager command API does not properly enforce authentication for privileged functions. An unauthenticated attacker with network access to the affected API could exploit this vulnerability to access privileged management functions.
CVSS 3.1 breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H- Attack vector
- Network
- Complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High