Description
Credentials of built-in users are insecurely stored in the User directory of PcVue projects, all versions prior to 17.0.0. A local attacker could retrieve users’ credentials. 

Active Directory accounts are not affected by this vulnerability.
Published: 2026-07-07
Score: 6.8 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Credentials for built‑in users are stored in the User directory of PcVue projects without proper protection. A local attacker who can access the system’s filesystem can read these credentials, enabling unauthorized account use and potential escalation. This weakness is an instance of insecure direct storage of passwords, classified as CWE‑256.

Affected Systems

The vulnerability affects all versions of Arcinfo PcVue prior to 17.0.0, including any projects that load User directories from earlier releases. The official fix is to install PcVue 17.0.0 (release 17.0.0902.3726) or newer, which removes the ability to load User directories containing insecure credentials. If existing projects were designed with an earlier version, they must be migrated using the ProjectUtility CLI tool as documented.

Risk and Exploitability

The vulnerability’s CVSS score of 6.8 indicates moderate severity. Because only local access is sufficient to read the stored credentials, the risk is confined to individuals who can physically or otherwise access the control system. The EPSS score is under 1%, reflecting a low but non‑zero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Nonetheless, if an attacker gains local access, they could retrieve credentials and impersonate built‑in users, potentially compromising the system’s integrity.

Generated by OpenCVE AI on July 26, 2026 at 19:28 UTC.

Remediation

Vendor Solution

Harden the configuration Who should apply this recommendation: All users To reduce the risk of exploitation, ARC Informatique strongly recommends implementing the following defensive measures: * Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from insecure networks. * Locate control system networks and remote devices behind firewalls and isolate them from business networks. * When remote access is required, use secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as its connected devices. Additional deployment guidance and recommended practices are available in the product documentation ( Hardening Guide https://www.pcvue.com/ProductHelp/PcVue/en/Content/Deployment/hardening-guide/overview.php ). Update PcVue Who should apply this recommendation: All users using the affected component Apply the corrective update by installing PcVue Initial Release 17.0.0 or later In a patched release, it will no longer be possible to load User directory from earlier versions. Existing projects designed with an earlier version require explicit migration using the ProjectUtility CLI tool. Instructions are provided in the product documentation ( Project Utility CLI reference https://www.pcvue.com/ProductHelp/PcVue/en/Content/Deployment/tools/project-utility-cli.php ). To verify that the patch is applied correctly, you must check that the File version property of the file ./bin/sv32.exe matches release 17.0.0 (17.0.0902.3726) or later, and ensure that any earlier release is no longer used. Available patches: Patch provided in: * PcVue 17.0.0 (17.0.0902.3726)

OpenCVE Recommended Actions

  • Apply the patch by installing PcVue 17.0.0 or newer, which removes the ability to load User directories with insecure credentials
  • For existing projects that rely on User directories from earlier releases, run the ProjectUtility CLI tool to migrate to the new format as detailed in the product documentation
  • Implement ARC Informatique’s hardening recommendations: isolate control system networks, minimize exposure, use VPNs for remote access, and keep VPN software up‑to‑date

Generated by OpenCVE AI on July 26, 2026 at 19:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

References
Link Providers
https://www.pcvue.com/security/#SB2026-5 cve-icon
History

Tue, 07 Jul 2026 12:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 07 Jul 2026 10:15:00 +0000

Type Values Removed Values Added
Description Credentials of built-in users are insecurely stored in the User directory of PcVue projects, all versions prior to 17.0.0. A local attacker could retrieve users’ credentials.  Active Directory accounts are not affected by this vulnerability.
Title Insecure password storage in User directory
First Time appeared Arcinfo
Arcinfo pcvue
Weaknesses CWE-256
CPEs cpe:2.3:a:arcinfo:pcvue:*:*:*:*:*:*:*:*
Vendors & Products Arcinfo
Arcinfo pcvue
References
Metrics cvssV4_0

{'score': 6.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/AU:Y/R:U/RE:M/U:Amber'}

Subscriptions

Arcinfo Pcvue
cve-icon MITRE

Status: PUBLISHED

Assigner: arcinfo

Published:

Updated: 2026-07-07T12:09:29.277Z

Reserved: 2026-07-06T13:45:31.176Z

Link: CVE-2026-14867

cve-icon Vulnrichment

Updated: 2026-07-07T12:09:24.840Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-26T19:30:03Z

Weaknesses
  • CWE-256

    Plaintext Storage of a Password