A SCADA Manager That Will Send SMS For Anybody
ICSA-26-258-03 pairs a 9.8-rated missing-authorisation flaw in mySCADA myPRO Manager with an open HTTP endpoint that pushes arbitrary messages out through the site's GSM modem.
Two flaws, and the combination is worse than either. CISA issued ICSA-26-258-03 on 15 September for mySCADA myPRO Manager, versions 2.1 and earlier.
The first, CVE-2026-73807, is a missing authorisation weakness (CWE-862) scored 9.8. The command API fails to enforce authentication on privileged functions, so an unauthenticated attacker on the network can, in CISA's phrasing, access privileged management functions. The second, CVE-2026-82567, is a missing authentication for a critical function (CWE-306) at 6.3: an unprotected HTTP endpoint lets an attacker send arbitrary SMS messages through the connected modem.
That modem is usually the site's alarm callout path. On a small water district or a food plant, myPRO Manager is the supervisory layer in front of the PLCs and the GSM link is the only out-of-band route to the person on call at two in the morning. An attacker with both flaws can act on the process and shape what the on-call engineer is told about it — either silence or a plausible message about something else.
Version 2.2 fixes both and is available through the in-app notification or from mySCADA's download page. The report came to CISA from Shirshak at Secnora OÜ, and no public exploitation had been reported as of the advisory date.
The sector list is long: critical manufacturing, energy, food and agriculture, transportation systems, water and wastewater, deployed worldwide. The lower score on the SMS flaw is worth ignoring. On its own it's a nuisance; next to an unauthenticated management API it is the part that decides whether anyone finds out.