# CVE-2026-1692: ARC Informatique PcVue Missing Origin Validation in WebSockets

Source: https://junglewise.ai/threats/cve-2026-1692-arc-informatique-pcvue-missing-origin-validation-in-websockets  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-02-26. Updated: 2026-07-09  
License: CC BY 4.0 with a link back

CVE-2026-1692 · Severity: medium · CVSS 6.1 · Published 2026-02-26

A security vulnerability exists in PcVue, a software platform used for monitoring industrial and building automation systems. The flaw affects web-based features like WebVue and TouchVue, potentially allowing a remote attacker to trick an authenticated user into visiting a malicious website. This could lead to unauthorized actions being performed on the user's behalf within the monitoring system.

Technologies: [ARC Informatique PcVue](https://junglewise.ai/threats/technologies/pcvue). Vendors: [ARC Informatique](https://junglewise.ai/threats/vendors/arc-informatique).

## Quick answers

**Is CVE-2026-1692 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-1692 being exploited in the wild.

**How severe is CVE-2026-1692?** Medium severity, with a CVSS score of 6.1, published 26 February 2026.

**Which products and versions are affected?** ARC Informatique PcVue 12.0.0 through 16.3.3.

**Is there a fix for CVE-2026-1692?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-1692 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-1692?** Check whether you run ARC Informatique PcVue at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A missing origin validation vulnerability (CWE-1385) exists in the GraphicalData web services of PcVue. The flaw specifically affects the SignalR WebSocket endpoints 'GraphicalData/js/signalR/connect' and 'GraphicalData/js/signalR/reconnect'. Because the application fails to properly validate the 'Origin' header during the WebSocket handshake, a remote attacker can lure an authenticated user to a malicious site that initiates a WebSocket connection to the vulnerable server. This allows the attacker to interact with the web service using the victim's session context. The vulnerability impacts versions 12.0.0 through 16.3.3 and is addressed in version 16.3.4 and other recent patches.

## Affected products

- ARC Informatique PcVue 12.0.0 through 16.3.3

## Timeline

- 2026-02-26: disclosed
- 2026-02-26: advisory

## References

- [https://www.pcvue.com/security/](https://www.pcvue.com/security/)

## Related threats

- [ARC Informatique PcVue Inadequate Encryption Strength in User Directory](https://junglewise.ai/threats/cve-2026-14868-arc-informatique-pcvue-inadequate-encryption-strength-in-user)
- [ARC Informatique PcVue plaintext storage of credentials in User directory](https://junglewise.ai/threats/cve-2026-14867-arc-informatique-pcvue-plaintext-storage-of-credentials-in-user)
- [ARC Informatique PcVue HTTP Host header attack in WebClient and WebScheduler](https://junglewise.ai/threats/cve-2026-1698-arc-informatique-pcvue-http-host-header-attack-in-webclient-and)
- [ARC Informatique PcVue missing cookie attributes in WebClient](https://junglewise.ai/threats/cve-2026-1697-arc-informatique-pcvue-missing-cookie-attributes-in-webclient)
- [ARC Informatique PcVue Improper HTTP Security Headers](https://junglewise.ai/threats/cve-2026-1696-arc-informatique-pcvue-improper-http-security-headers)