{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-1698","assignerOrgId":"87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932","state":"PUBLISHED","assignerShortName":"arcinfo","dateReserved":"2026-01-30T08:38:11.209Z","datePublished":"2026-02-26T07:58:00.626Z","dateUpdated":"2026-03-26T08:25:09.394Z"},"containers":{"cna":{"providerMetadata":{"orgId":"87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932","shortName":"arcinfo","dateUpdated":"2026-03-26T08:25:09.394Z"},"title":"HTTP Host header vulnerability in WebClient and WebScheduler web apps","datePublic":"2026-02-25T23:00:00.000Z","problemTypes":[{"descriptions":[{"lang":"en","cweId":"CWE-644","description":"CWE-644 Improper Neutralization of HTTP Headers for Scripting Syntax","type":"CWE"}]}],"affected":[{"vendor":"arcinfo","product":"PcVue","modules":["WebVue","WebScheduler"],"versions":[{"status":"affected","version":"16.0.0","lessThanOrEqual":"16.3.3","versionType":"cpe"},{"status":"affected","version":"15.0.0","lessThanOrEqual":"15.2.13","versionType":"cpe"}],"defaultStatus":"unaffected"}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:arcinfo:pcvue:*:*:*:*:*:*:*:*","versionEndIncluding":"16.3.3","versionStartIncluding":"16.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:arcinfo:pcvue:*:*:*:*:*:*:*:*","versionEndIncluding":"15.2.13","versionStartIncluding":"15.0.0","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"OR"}],"descriptions":[{"lang":"en","value":"A HTTP Host header attack vulnerability affects WebClient and the WebScheduler web apps of PcVue in version 15.0.0 through 16.3.3 included, allowing a remote attacker to inject harmful payloads that manipulate server-side behavior.\n\nThis vulnerability only affects the endpoints /Authentication/ExternalLogin, /Authentication/AuthorizationCodeCallback and /Authentication/Logout\nof the WebClient and WebScheduler web apps.","supportingMedia":[{"type":"text/html","base64":false,"value":"A HTTP Host header attack vulnerability affects WebClient and the WebScheduler web apps of PcVue in version 15.0.0 through 16.3.3 included, allowing a remote attacker to inject harmful payloads that manipulate server-side behavior.

This vulnerability only affects the endpoints /Authentication/ExternalLogin, /Authentication/AuthorizationCodeCallback and /Authentication/Logout
of the WebClient and WebScheduler web apps.
"}]}],"references":[{"url":"https://www.pcvue.com/security/#SB2026-2","tags":["vendor-advisory"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV4_0":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"LOW","subConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","subIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"YES","Recovery":"USER","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"MODERATE","providerUrgency":"CLEAR","version":"4.0","baseSeverity":"MEDIUM","baseScore":5.3,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:L/SA:N/AU:Y/R:U/RE:M/U:Clear"}},{"other":{"type":"ssvc","content":{"options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CNA","version":"2.0.3"}},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"solutions":[{"lang":"en","value":"Harden the configuration\nWho should apply this recommendation: All users\n\n\nTo reduce the risk of exploitation, ARC Informatique strongly recommends implementing the following defensive measures:\n\n * Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from insecure networks.\n * Locate control system networks and remote devices behind firewalls and isolate them from business networks.\n * When remote access is required, use secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as its connected devices.\n\n\n\nUninstall the Web Server \nWho should apply this recommendation: All users not using the affected component \n\nIf your system does not require the use of the Web & Mobile features, you should make sure not to install them. If your system requires the use of the Web & Mobile features, they should be installed only on the Web Server.\nSee the product help related to the installation for more information.\n\n\nUpdate the Web Deployment Console (WDC) and re deploy the Web Server\nWho should apply this recommendation: \n\nAll users running affected components.\n\n\n\nInstall a patched release of the Web Deployment Console (WDC) on the IIS Web server and use it to re-deploy the Web Site. Some settings might need to be updated if third-party web apps or services depend on the OAuth ROPC flow.\n\nIn a patched release of the WDC, new settings are available for each authorized Client to enable or disable:\n * The Authorization Code flow\n * The Authorization Code flow with PKCE\n * The Resource Owner Password Credentials (ROPC) flow\n\n\nBy default, all the OAuth flows are now disabled for third-party web apps and need to be manually enabled before deployment if required.\n\nTo verify that the patch is applied correctly, you must check that:\n * The File version property of the file ./bin/Modules/WebDeployment/WebDeploymentConsole.exe matches the deployed release or later, and ensure that any earlier release is no longer used;\n * Web Sites have been redeployed;\n * OAuth flow are correctly set for each authorized Client.\n\n\n\n\n\nAvailable patches:\nPatch provided in:\n * PcVue 16.3.4 (16.3.4902.3112)\n * PcVue 15.2.14 (15.2.14900.37147)","supportingMedia":[{"type":"text/html","base64":false,"value":"Harden the configuration
Who should apply this recommendation: All users
\n\nTo reduce the risk of exploitation, ARC Informatique strongly recommends implementing the following defensive measures:\n\n
Uninstall the Web Server
Who should apply this recommendation: All users not using the affected component

If your system does not require the use of the Web & Mobile features, you should make sure not to install them. If your system requires the use of the Web & Mobile features, they should be installed only on the Web Server.
See the product help related to the installation for more information.


Update the Web Deployment Console (WDC) and re deploy the Web Server
Who should apply this recommendation: \n\nAll users running affected components.\n\n

Install a patched release of the Web Deployment Console (WDC) on the IIS Web server and use it to re-deploy the Web Site. Some settings might need to be updated if third-party web apps or services depend on the OAuth ROPC flow.

In a patched release of the WDC, new settings are available for each authorized Client to enable or disable:
By default, all the OAuth flows are now disabled for third-party web apps and need to be manually enabled before deployment if required.

To verify that the patch is applied correctly, you must check that:

\n\nAvailable patches:
Patch provided in:
"}]}],"exploits":[{"lang":"en","value":"No POC available.","supportingMedia":[{"type":"text/html","base64":false,"value":"No POC available."}]},{"lang":"en","value":"Not known to be exploited","supportingMedia":[{"type":"text/html","base64":false,"value":"Not known to be exploited"}]}],"source":{"advisory":"SB2026-2","discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-02-26T14:30:06.903784Z","id":"CVE-2026-1698","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-02-26T14:30:21.442Z"}}]}}