CVE-2026-73807
CriticalCVSS 9.8Summary
The mySCADA myPRO Manager command API does not properly enforce authentication for privileged functions. An unauthenticated attacker with network access to the affected API could exploit this vulnerability to access privileged management functions.
Risk Assessment
An attacker can perform privileged management operations without logging in, potentially taking control of the SCADA system. This may disrupt industrial infrastructure operations.
Recommendation
Apply the vendor patch that enforces authentication in the command API. Until patched, restrict network access to the myPRO Manager API, for example via a firewall.
Related vulnerabilities
- CVE-2026-81855Critical
A hardcoded cryptographic client authentication key vulnerability exists in the robot testing framework component of Wärtsilä FOS-Onboard. The key is embedded in the software and cannot be changed by administrators.
- CVE-2026-78225Critical
A hardcoded cryptographic server key vulnerability exists in the deployer-ng Update Controller component of Wärtsilä FOS-Onboard. The key is embedded in the software and cannot be changed by administrators.
- CVE-2026-73437Critical
On affected platforms running Arista EOS with Dynamic Host Configuration Protocol (DHCP) relay configured, an unauthenticated attacker with network access could send a crafted DHCP reply packet from an IP address that is not configured as a helper address, and the relay agent would forward it to clients without validating the source.
- CVE-2026-61560Critical
`@zereight/mcp-gitlab` is a Model Context Protocol server for GitLab. Prior to version 2.1.27, the SSE transport mode (`SSE=true`) exposes all MCP tools without any authentication. The `upload_markdown` tool reads arbitrary files from the server's local filesystem via an unsanitized `file_path` parameter and uploads them to a GitLab project.
- CVE-2026-91939Critical
Cotonti 1.0.0 Comments plugin passes the ci GET parameter to unserialize() without allowed_classes restriction, allowing unauthenticated attackers to instantiate arbitrary PHP classes with attacker-controlled properties. Attackers can exploit PHP object injection through crafted serialized payloads to trigger gadget chains and achieve database manipulation or code execution.
- CVE-2026-68491Critical
An insufficient check allowed for the overwrite of arbitrary files via a symlink. Technical details were not provided in the description.
- CVE-2026-66890Critical
The affected products use hard-coded credentials, which could allow remote access to files with root privileges where FTP is reachable. Technical details were not provided in the description.
- CVE-2026-66887Critical
The affected products are missing authorization on state-changing CGIs and session checks are not performed. Technical details were not provided in the description.
- CVE-2026-61568Critical
`@zereight/mcp-gitlab` is a Model Context Protocol server for GitLab. Versions prior to 2.1.30 expose the Streamable HTTP MCP endpoint without an effective Host or Origin allowlist. A malicious web page can use DNS rebinding to route browser requests to a victim's local MCP listener while preserving an attacker-controlled `Host` and `Origin`.
- CVE-2026-61559Critical
The @zereight/mcp-gitlab MCP server, in versions from 0.0.1 to 2.1.26 with ENABLE_DYNAMIC_API_URL=true, reads the X-GitLab-API-URL HTTP header and uses it as the base URL for outbound GitLab API calls. The server only validates URL format without any allowlist or hostname restriction, then attaches the victim's Private-Token to every redirected request. Version 2.1.27 contains a patch.
Original NVD description (English source)
The mySCADA myPRO Manager command API does not properly enforce authentication for privileged functions. An unauthenticated attacker with network access to the affected API could exploit this vulnerability to access privileged management functions.