mySCADA myPRO Manager CVE-2026-73807

Exploitation requires only network reachability to the mySCADA myPRO Manager command API - no credentials, no user interaction, and default configurations are affected (AV:N/AC:L/PR:N/UI:N). The single meaningful limiting factor is network exposure: myPRO Manager is OT/SCADA management software typically deployed on segmented industrial or plant networks, so exploitation depends on the attacker having a route to the API (e.g., flat network, VPN foothold, or an improperly exposed/internet-facing management interface). Any attacker who can reach the API can invoke privileged management functions.

This is a genuine high-priority vulnerability by its intrinsic characteristics. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, base 9.3) describes a fully remote, unauthenticated, low-complexity flaw with high impact to confidentiality, integrity, and availability - the worst-case profile for an internet- or network-reachable service. CWE-862 (Missing Authorization) combined with the description ('does not properly enforce authentication for privileged functions') confirms an authentication/authorization gap on privileged management APIs. However, the exploitation-probability signals are notably more modest and should temper prioritization urgency: EPSS is only 0.65% (50th percentile), there is NO CISA KEV listing, and NO public POC is identified. The near-median EPSS despite the 9.3 score is typical of newly-published ICS advisories with no observed exploitation yet, and reflects the limited, non-internet-facing deployment footprint of SCADA management software rather than a defect in the severity rating. There is no SSVC decision data in the input to cross-reference. Net: the vulnerability is technically severe and trivially exploitable IF an attacker has network reach to the API, but current real-world exploitation evidence is absent - this is a patch-promptly item for OT operators, not a confirmed active-exploitation emergency.

An attacker with network access to the mySCADA myPRO Manager command API sends requests directly to privileged management endpoints without supplying valid credentials, and the server executes them because authentication is not enforced. This grants control over management functions of the SCADA/HMI environment, potentially altering configuration or process-control data. No public exploit code is identified at time of analysis, but the low attack complexity (AC:L, no user interaction) means weaponization would be straightforward once the API is reachable.