CVE-2026-14867: PcVue Insecure Credential Storage in Built-In User Accounts

Technical summary

CVE-2026-14867 involves insecure credential storage (CWE-256) in PcVue's User directory. The CVSS 3.1 score of 5.5 (MEDIUM) reflects local attack vector, low complexity, and low privilege requirements, with high confidentiality impact but no integrity or availability impact. The vulnerability does not affect Active Directory accounts, limiting exposure for environments using centralized authentication. Exploitation requires local system access and does not require user interaction.

Business impact

Compromise of built-in user credentials could allow attackers to escalate privileges within PcVue and access sensitive industrial control or SCADA data depending on deployment context. The risk is primarily relevant for organizations using local authentication in PcVue rather than directory-integrated methods. Credential exposure could facilitate lateral movement if PcVue credentials are reused across systems.

Affected systems

ArcInfo PcVue versions prior to 17.0.0 are affected. Only built-in user accounts are at risk; Active Directory accounts are not vulnerable. Organizations using PcVue 17.0.0 or later are unaffected.

Exploitability

Exploitation requires local system access and no elevated privileges, making this vulnerability moderately exploitable within organizations where untrusted users have local system access. No network-based exploitation is possible. The vulnerability is not listed on the CISA KEV catalog, indicating no known active exploitation in the wild as of publication.

Remediation

Upgrade PcVue to version 17.0.0 or later. Organizations unable to upgrade immediately should restrict local system access to trusted users only and review PcVue user account configurations to identify built-in accounts that may require credential rotation post-patching.

Patch guidance

Apply PcVue version 17.0.0 or later. Verify compatibility with your deployment before upgrading. If migration is complex or staged, prioritize systems where untrusted users have local access. After patching, consider rotating credentials for any built-in accounts that may have been exposed.

Detection guidance

Monitor for unauthorized access to the User directory in PcVue installation paths. Audit local system access logs for users accessing PcVue credential storage locations. Review PcVue authentication logs for unusual login attempts using built-in accounts. Organizations should establish baseline access patterns to detect anomalies post-patch to ensure remediation effectiveness.

Why prioritize this

While scored as MEDIUM severity, prioritization depends on deployment context. Organizations with local-authentication PcVue instances where untrusted users have system access should prioritize patching. Those using Active Directory integration or with restricted local access may defer patching to a standard maintenance window. The lack of KEV listing and active exploitation should not delay patching for high-risk environments.

Risk score, explained

The CVSS 3.1 score of 5.5 reflects the local-only attack vector and requirement for user privileges, balanced against high confidentiality impact from credential disclosure. The score appropriately captures that this is a data confidentiality risk rather than system availability or integrity compromise. The absence of network exploitability and requirement for local presence keeps the score in the MEDIUM range.

Frequently asked questions