CVE-2026-82567: myPRO Manager Authentication Bypass Flaw

CVE-2026-82567 Overview

CVE-2026-82567 affects the mySCADA myPRO Manager notification gateway. The product exposes an unauthenticated HTTP endpoint used to relay SMS messages through a connected Global System for Mobile Communications (GSM) modem. Any client with network reachability to the gateway can submit a phone number and message body, and the service will dispatch the SMS without verifying the caller's identity.

The issue is tracked under CWE-862: Missing Authorization and is documented in CISA ICS Advisory ICSA-26-258-03.

Critical Impact
An unauthenticated attacker on the adjacent network can send arbitrary SMS messages through the connected GSM modem, enabling smishing, notification spoofing, and abuse of the operator's SMS budget.

Affected Products

mySCADA myPRO Manager notification gateway
Deployments exposing the SMS gateway HTTP endpoint on adjacent networks
Industrial control system (ICS) environments using myPRO Manager for GSM-based operator alerts

Discovery Timeline

2026-09-15 - CVE-2026-82567 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database
2026-09-16 - CISA published ICS advisory ICSA-26-258-03

Technical Details for CVE-2026-82567

Vulnerability Analysis

The myPRO Manager notification gateway provides an HTTP interface that accepts SMS dispatch requests. The endpoint receives a destination phone number and message body, then forwards the payload to a connected GSM modem for transmission. The service does not enforce authentication, authorization, or origin validation before processing the request.

An attacker on the adjacent network can craft HTTP requests to the exposed endpoint and cause the gateway to transmit arbitrary SMS traffic. Attackers can spoof operator alerts, deliver phishing links that appear to originate from a trusted operational technology (OT) system, or exhaust prepaid SMS credit on the associated Subscriber Identity Module (SIM). The gateway's identity as the SMS sender lends credibility to malicious content.

The defect maps to CWE-862: Missing Authorization. No public proof-of-concept, exploit code, or CISA Known Exploited Vulnerabilities (KEV) entry exists at publication time.

Root Cause

The HTTP endpoint responsible for SMS dispatch omits an authorization check. The handler treats any well-formed request as authorized and passes the phone number and message parameters directly to the modem interface. There is no session token, API key, mutual Transport Layer Security (mTLS), or network access control tied to the endpoint.

Attack Vector

Exploitation requires network access to the notification gateway on the adjacent network segment. The attacker sends an HTTP request specifying the target phone number and message content. The gateway accepts the request and instructs the connected GSM modem to transmit the SMS. No credentials, user interaction, or prior compromise are required.

No verified exploit code is available. See ICSA-26-258-03 and the CSAF document for vendor-published technical details.

Detection Methods for CVE-2026-82567

Indicators of Compromise

Unexpected HTTP POST or GET requests to the myPRO Manager SMS gateway endpoint from hosts not on the approved operator allow list.
Outbound SMS traffic from the connected GSM modem to phone numbers outside the documented notification distribution list.
Complaints from recipients about SMS messages that reference the ICS environment but were not authorized by operations staff.
Abnormal spikes in SMS volume or SIM credit consumption on the modem account.

Detection Strategies

Instrument the notification gateway host with process and network telemetry, and alert on inbound HTTP connections to the SMS endpoint from unexpected source addresses.
Correlate gateway HTTP request logs with modem transmission logs to identify SMS sends that lack a corresponding operational trigger.
Deploy network intrusion detection signatures for HTTP requests targeting the vendor-documented SMS URI path from non-management subnets.

Monitoring Recommendations

Forward HTTP access logs from the myPRO Manager host to a central logging platform for retention and analysis.
Enable modem-side accounting to record every SMS transmission with timestamp, destination number, and message length.
Review SMS gateway activity daily during initial exposure assessment and weekly thereafter.

How to Mitigate CVE-2026-82567

Immediate Actions Required

Restrict network reachability to the myPRO Manager notification gateway using firewall rules that permit only authorized management hosts.
Place the gateway on an isolated OT management segment and block inbound traffic from user or business networks.
Audit recent SMS transmission logs and modem billing records for unauthorized activity.
Notify recipients of the SMS notification list of the potential for spoofed operational messages until the endpoint is secured.

Patch Information

Refer to ICSA-26-258-03 and the mySCADA Documentation Download portal for vendor-supplied fixed versions and update procedures. Apply the vendor-published update as soon as it is available for your deployment.

Workarounds

Enforce network-layer access control lists to block all traffic to the SMS gateway endpoint from untrusted sources.
Terminate the endpoint behind a reverse proxy that requires authentication before forwarding requests to the gateway.
Disable the SMS notification feature until a patched version is deployed if operational requirements permit.
Rotate or replace the SIM in the connected GSM modem if unauthorized SMS activity is confirmed.

bash

# Example iptables rule restricting the SMS gateway endpoint to a management host
iptables -A INPUT -p tcp --dport 80 -s 10.10.20.5 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP