The mySCADA myPRO Manager command API does not properly enforce authentication for privileged functions.

CVE-2026-73807 is a missing-authentication flaw (CWE-862) in mySCADA myPRO Manager, the web-based management console used to license, deploy, and control myPRO SCADA/HMI runtime instances. The command API exposes privileged functions — version switching, configuration changes, and OS-level management operations — without enforcing any authentication. An unauthenticated attacker who can reach the Manager's listening port (typically TCP/11000 or TCP/10001) can invoke these functions directly via crafted HTTP POST requests. Affected versions are myPRO Manager < 1.4 (and likely the corresponding myPRO Runtime < 9.3). This is the *fourth* critical unauthenticated-access vulnerability disclosed in mySCADA myPRO Manager since late 2024, following CVE-2024-47407, CVE-2024-52034, and CVE-2024-47138 — all sharing the same pattern of zero-auth command execution.

The vendor's CRITICAL / 9.8 rating is accurate and, if anything, conservative for this product class. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) correctly reflects the trivial exploitation path — no credentials, no user interaction, low complexity. Prior near-identical flaws in the same product already have a public Metasploit module (exploit/windows/scada/mypro_mgr_cmd) and Tenable detection plugins. The only reason this isn't scored 10.0 is the S:U (unchanged scope) designation; a scope-change argument could be made given that the Manager controls downstream Runtime instances and connected PLCs. For an OT/ICS management plane, this is as bad as unauthenticated RCE gets.

Why this verdict

• Zero-authentication attack surface: The API requires no credentials, tokens, or sessions. Any network-reachable attacker can invoke privileged functions with a single HTTP POST — the attack complexity is genuinely trivial.
• Role multiplier: mySCADA myPRO Manager is canonically an OT/ICS/SCADA management component. 100% of installations occupy the high-value role by definition. Successful exploitation grants control over HMI visualizations, PLC communication parameters, and SCADA runtime configurations. The blast radius extends from host-level to operational-safety impact on connected industrial processes.
• Proven exploitation pattern: This is the fourth unauthenticated-access CVE in the same product since November 2024 (CVE-2024-47407, CVE-2024-52034, CVE-2024-47138). A Metasploit module rated 'Excellent' reliability already exists for the prior variant. Weaponization time for this new CVE is measured in days, not weeks.
• Default-unsafe configuration: The Manager service binds to all network interfaces on installation and the myscada9 administrative user is auto-provisioned with elevated privileges — no hardening is applied out of the box.

Why not higher?

A 9.8 is already near-maximum. The only argument for 10.0 would be a Scope change (S:C) to reflect the Manager→Runtime→PLC control chain, but the vendor scored it S:U and we lack evidence that the API flaw itself directly crosses a security boundary in the CVSS definition. The score stays at 9.8.

Why not lower?

Despite the small global installed base and the expectation that OT networks are segmented, three factors block any downgrade: (1) the component is *definitionally* a SCADA management plane — the high-value-role floor is CRITICAL; (2) the exploit chain has zero friction once network access is achieved; (3) public Metasploit tooling for the identical pattern already exists. A generic 'requires internal network access' argument does not break the floor because internal OT access is the *expected* attacker position in ICS threat models (post-initial-access via IT-OT boundary or VPN compromise is standard TTPs for groups like CHERNOVITE/PIPEDREAM and ELECTRUM/INDUSTROYER).

1. Immediately restrict network access to myPRO Manager ports (TCP/11000, TCP/10001) to authorized management stations only — Apply host-based firewall rules or network ACLs limiting inbound connections to the Manager API to a whitelist of known administrator IPs. This is the single most effective control — it eliminates the unauthenticated remote attack vector entirely. Deploy within 3 days per noisgate CRITICAL mitigation SLA.
2. Place myPRO Manager behind an authenticating reverse proxy — If the Manager API must remain accessible, front it with an nginx/HAProxy instance that enforces certificate-based mutual TLS or SAML authentication before requests reach the Manager. This compensates for the missing built-in authentication. Deploy within 3 days.
3. Enable process-creation monitoring on the Manager host — Deploy Sysmon or EDR on the Windows host running myPRO Manager. Alert on any child process (cmd.exe, powershell.exe, wscript.exe) spawned by the myPRO Manager service process. This provides detection-in-depth while the patch is staged.
4. Audit IT-OT boundary for unauthorized paths to the Manager VLAN — Verify that no VPN split-tunnel, misconfigured firewall rule, or flat network segment provides unintended IT-side reachability to the OT VLAN where myPRO Manager resides. This is the most common way the 'OT segmentation' assumption fails in practice.

Run this script on each Windows host where myPRO Manager is installed. Execute from an elevated PowerShell prompt (Run as Administrator). Example: .\Check-CVE-2026-73807.ps1. No external dependencies required.

#!/usr/bin/env powershell
# Check-CVE-2026-73807.ps1
# Checks whether mySCADA myPRO Manager is installed and whether
# the installed version is vulnerable to CVE-2026-73807.
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 1 = VULNERABLE, 0 = PATCHED, 2 = UNKNOWN

$ErrorActionPreference = 'Stop'

# Known-safe version (estimated — confirm with vendor advisory)
$patchedVersion = [version]'1.4.0'

try {
    # Check registry for mySCADA installation
    $regPaths = @(
        'HKLM:\SOFTWARE\mySCADA\myPRO Manager',
        'HKLM:\SOFTWARE\WOW6432Node\mySCADA\myPRO Manager'
    )
    $installed = $false
    $installedVersion = $null

    foreach ($path in $regPaths) {
        if (Test-Path $path) {
            $installed = $true
            $ver = (Get-ItemProperty -Path $path -ErrorAction SilentlyContinue).Version
            if ($ver) { $installedVersion = $ver; break }
        }
    }

    # Fallback: check for mySCADA service and binary
    if (-not $installed) {
        $svc = Get-Service -Name '*myscada*' -ErrorAction SilentlyContinue
        if ($svc) {
            $installed = $true
            # Try to get version from binary
            $proc = Get-Process -Name '*myscada*' -ErrorAction SilentlyContinue | Select-Object -First 1
            if ($proc -and $proc.Path) {
                $fileVer = (Get-Item $proc.Path).VersionInfo.ProductVersion
                if ($fileVer) { $installedVersion = $fileVer }
            }
        }
    }

    # Fallback: check common install paths
    if (-not $installed) {
        $commonPaths = @(
            'C:\Program Files\mySCADA\',
            'C:\Program Files (x86)\mySCADA\',
            'C:\mySCADA\'
        )
        foreach ($cp in $commonPaths) {
            if (Test-Path $cp) {
                $installed = $true
                $exe = Get-ChildItem -Path $cp -Recurse -Filter '*.exe' -ErrorAction SilentlyContinue | Select-Object -First 1
                if ($exe) {
                    $fileVer = $exe.VersionInfo.ProductVersion
                    if ($fileVer) { $installedVersion = $fileVer }
                }
                break
            }
        }
    }

    if (-not $installed) {
        Write-Host 'UNKNOWN - mySCADA myPRO Manager not detected on this host'
        exit 2
    }

    if (-not $installedVersion) {
        Write-Host "UNKNOWN - mySCADA myPRO Manager is installed but version could not be determined. Manual check required."
        exit 2
    }

    # Normalize and compare version
    $currentVersion = [version]($installedVersion -replace '[^0-9.]','')
    Write-Host "Detected myPRO Manager version: $installedVersion"

    if ($currentVersion -lt $patchedVersion) {
        Write-Host "VULNERABLE - myPRO Manager $installedVersion is below patched version $patchedVersion (CVE-2026-73807)"
        exit 1
    } else {
        Write-Host "PATCHED - myPRO Manager $installedVersion meets or exceeds patched version $patchedVersion"
        exit 0
    }
} catch {
    Write-Host "UNKNOWN - Error during check: $($_.Exception.Message)"
    exit 2
}

Sources

1. CISA ICS Advisory ICSA-24-326-07 — mySCADA myPRO Manager
2. Rapid7 Metasploit Module — myPRO Manager Unauthenticated Command Injection
3. Metasploit Framework PR #19846 — mySCADA exploit module
4. PRODAFT Research — mySCADA myPRO Manager Critical Flaws
5. Tenable Plugin 214704 — mySCADA PRO Manager Command Injection
6. SecurityWeek — Vulnerabilities Expose mySCADA myPRO to Remote Hacking
7. FortiGuard OT Signature 57295 — mySCADA myPRO
8. mySCADA myPRO Documentation — Network Architecture