CVE-2026-73807CWE-862broken-access-control

CVE-2026-73807

Critical · published September 16, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
55.4
In the wild
Unconfirmed
What it is

The mySCADA myPRO Manager command API does not properly enforce authentication for privileged functions. An unauthenticated attacker with network access to the affected API could exploit this vulnerability to access privileged management functions.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
9.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00778 · 55.4th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-09-16T02:16Z
References (3)
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-258-03.json · [email protected]https://www.cisa.gov/news-events/ics-advisories/icsa-26-258-03 · [email protected]https://www.myscada.org/downloads/mySCADAPROManager/ · [email protected]
EPSS history
Timeline
  • 17 SEP 03:32Z
    EPSS moved — → 1%
    epss
  • 15 SEP 21:42Z
    mySCADA myPRO Manager Missing Authorization
    cvelistv5