Cyber Posture

CVE-2026-1693

High

Published: 26 February 2026

Published
26 February 2026
Modified
12 March 2026
KEV Added
Patch
CVSS Score 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score 0.0006 19.1th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-1693 is a high-severity Use of Obsolete Function (CWE-477) vulnerability in Arcinformatique Pcvue. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 19.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique.
Threat & Defense Details

Likely Mitigating ControlsAI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-1390

Helps detect exploitation of weak authentication mechanisms by notifying of previous unauthorized logons.

addresses: CWE-1390

The IA policy requires strong authentication methods, reducing use of weak authentication.

addresses: CWE-1390

Enforces dynamic, context-aware authentication that mitigates weak static authentication by increasing requirements based on risk or conditions.

addresses: CWE-1390

Enforces authentication for users, reducing the viability of weak authentication mechanisms.

addresses: CWE-1390

Requires authentication mechanisms to meet applicable standards and guidelines, preventing weak authentication.

addresses: CWE-477

Institutionalized information sharing keeps developers aware of obsolete functions and the need to replace them with supported alternatives.

addresses: CWE-477

Regular reassessment flags use of obsolete functions whose security properties have degraded or whose replacements contain fixes for known weaknesses.

addresses: CWE-477

Eliminates reliance on functions or components explicitly declared obsolete and unsupported by their maintainers.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1552 Unsecured Credentials Credential Access
Adversaries may search compromised systems to find and obtain insecurely stored credentials.
Why these techniques?

Vulnerability is a remote unauthenticated flaw in public-facing web services (ROPC OAuth) directly enabling exploitation via T1190 and resulting in exposure of credentials matching T1552.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

The OAuth grant type Resource Owner Password Credentials (ROPC) flow is still used by the werbservices used by the WebVue, WebScheduler, TouchVue and Snapvue features of PcVue in version 12.0.0 through 16.3.3 included despite being deprecated. It might allow a…

more

remote attacker to steal user credentials.

Deeper analysisAI

CVE-2026-1693 is a vulnerability in the PcVue application, affecting versions 12.0.0 through 16.3.3 inclusive. It stems from the continued use of the deprecated OAuth grant type Resource Owner Password Credentials (ROPC) flow in the web services supporting the WebVue, WebScheduler, TouchVue, and Snapvue features. This insecure authentication mechanism, associated with CWE-477 (Insecure Use of OAuth) and CWE-1390 (Weak Authentication), could enable a remote attacker to steal user credentials. The issue carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating high confidentiality impact with no requirements for privileges or user interaction.

A remote attacker with network access to the affected PcVue instance can exploit this vulnerability without authentication. By leveraging the ROPC flow's transmission of usernames and passwords in requests to the web services, the attacker could intercept or extract credentials, potentially gaining unauthorized access to user accounts and associated resources within the PcVue environment.

The vendor has published a security bulletin at https://www.pcvue.com/security/#SB2026-2 addressing this issue, which security practitioners should consult for details on available patches or mitigation steps. The CVE was published on 2026-02-26.

Details

CWE(s)

Affected Products

arcinformatique
pcvue
12.0.0 — 15.2.13 · 16.0.0 — 16.3.4

CVEs Like This One

CVE-2025-12870Shared CWE-1390
CVE-2023-53894Shared CWE-1390
CVE-2025-40554Shared CWE-1390
CVE-2025-40552Shared CWE-1390
CVE-2026-28710Shared CWE-1390
CVE-2026-4828Shared CWE-1390
CVE-2026-4924Shared CWE-1390
CVE-2025-12871Shared CWE-1390
CVE-2026-6886Shared CWE-1390
CVE-2024-50563Shared CWE-1390

References