# CVE-2026-14867: ARC Informatique PcVue plaintext storage of credentials in User directory

Source: https://junglewise.ai/threats/cve-2026-14867-arc-informatique-pcvue-plaintext-storage-of-credentials-in-user  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-07. Updated: 2026-07-07  
License: CC BY 4.0 with a link back

CVE-2026-14867 · Severity: info · CVSS 6.8 · Published 2026-07-07

PcVue is a software platform used for monitoring and controlling industrial systems like power grids, water treatment, and building automation. A security flaw in older versions allows a person with local access to the computer to retrieve the login credentials of built-in users. This could allow an unauthorized individual to gain higher-level access to the control system, potentially disrupting operations or viewing sensitive industrial data.

Technologies: [ARC Informatique PcVue](https://junglewise.ai/threats/technologies/pcvue). Vendors: [ARC Informatique](https://junglewise.ai/threats/vendors/arc-informatique).

## Quick answers

**Is CVE-2026-14867 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-14867 being exploited in the wild.

**How severe is CVE-2026-14867?** Informational severity, with a CVSS score of 6.8, published 7 July 2026.

**Which products and versions are affected?** ARC Informatique PcVue All versions prior to 17.0.0.

**Is there a fix for CVE-2026-14867?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-14867 attacked?** It is attacked with local access, in a network appliance.

**Am I affected by CVE-2026-14867?** Check whether you run ARC Informatique PcVue at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A plaintext storage of passwords vulnerability (CWE-256) exists in ARC Informatique PcVue. The credentials for built-in user accounts are stored insecurely within the 'User' directory of PcVue projects. A local attacker with low privileges can access these files to retrieve credentials, potentially leading to unauthorized administrative access to the SCADA/HMI platform. This vulnerability does not affect Active Directory-integrated accounts. The issue is resolved in version 17.0.0.

## Affected products

- ARC Informatique PcVue All versions prior to 17.0.0

## Timeline

- 2026-07-07: advisory
- 2026-07-07: disclosed

## References

- [https://www.pcvue.com/security/](https://www.pcvue.com/security/)

## Related threats

- [ARC Informatique PcVue Inadequate Encryption Strength in User Directory](https://junglewise.ai/threats/cve-2026-14868-arc-informatique-pcvue-inadequate-encryption-strength-in-user)
- [ARC Informatique PcVue HTTP Host header attack in WebClient and WebScheduler](https://junglewise.ai/threats/cve-2026-1698-arc-informatique-pcvue-http-host-header-attack-in-webclient-and)
- [ARC Informatique PcVue missing cookie attributes in WebClient](https://junglewise.ai/threats/cve-2026-1697-arc-informatique-pcvue-missing-cookie-attributes-in-webclient)
- [ARC Informatique PcVue Improper HTTP Security Headers](https://junglewise.ai/threats/cve-2026-1696-arc-informatique-pcvue-improper-http-security-headers)
- [ARC Informatique PcVue XSS in OAuth web services](https://junglewise.ai/threats/cve-2026-1695-arc-informatique-pcvue-xss-in-oauth-web-services)