CVE-2026-82567CWE-862broken-access-control

CVE-2026-82567

Medium · published September 16, 2026

CVSS v3.1
6.3
EPSS
0%
Percentile
26.1
In the wild
Unconfirmed
What it is

The myPRO Manager notification gateway exposes an unauthenticated HTTP endpoint used to send SMS messages through a connected GSM modem. The endpoint is accessible over the network and does not require authentication before accepting a phone number and message from a request and sending the specified SMS message. An unauthenticated attacker with network access to the notification gateway could exploit this vulnerability to send arbitrary SMS messages through the connected modem.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
5.3 · CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
EPSS
0.00339 · 26.1th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-09-16T02:17Z
References (3)
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-258-03.json · [email protected]https://www.cisa.gov/news-events/ics-advisories/icsa-26-258-03 · [email protected]https://www.myscada.org/downloads/mySCADAPROManager/ · [email protected]
EPSS history
Timeline
  • 17 SEP 03:33Z
    EPSS moved — → 0%
    epss
  • 15 SEP 21:45Z
    mySCADA myPRO Manager Missing Authorization
    cvelistv5