CVE-2026-73807

9.3 criticalEPSS 0.8%

Critical (9.3). EPSS 0.8% chance of exploitation in the next 30 days.

The mySCADA myPRO Manager command API does not properly enforce authentication for privileged functions. An unauthenticated attacker with network access to the affected API could exploit this vulnerability to access privileged management functions.

Severity

CVSS 4.0

9.3 critical

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.8% chance of exploitation in the next 30 days; higher than 55% of CVEs (scores of 2026-10-31)
CWE: CWE-862
Published: 2026-09-15
Modified: 2026-09-18
Record from: the NVD, synced 2026-10-19

References

https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-258-03.json
https://www.cisa.gov/news-events/ics-advisories/icsa-26-258-03
https://www.myscada.org/downloads/mySCADAPROManager/

Check your stack JSON