# CVE-2026-1693: ARC Informatique PcVue use of deprecated OAuth ROPC flow

Source: https://junglewise.ai/threats/cve-2026-1693-arc-informatique-pcvue-use-of-deprecated-oauth-ropc-flow  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-02-26. Updated: 2026-07-09  
License: CC BY 4.0 with a link back

CVE-2026-1693 · Severity: high · CVSS 7.5 · Published 2026-02-26

PcVue is a monitoring and control platform used in industrial environments like power plants and smart buildings. A security issue exists where several of its web-based components use an outdated and insecure method for handling user logins. This could allow a remote attacker to intercept or steal user credentials, potentially leading to unauthorized access to industrial control systems.

Technologies: [ARC Informatique PcVue](https://junglewise.ai/threats/technologies/pcvue). Vendors: [ARC Informatique](https://junglewise.ai/threats/vendors/arc-informatique).

## Quick answers

**Is CVE-2026-1693 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-1693 being exploited in the wild.

**How severe is CVE-2026-1693?** High severity, with a CVSS score of 7.5, published 26 February 2026.

**Which products and versions are affected?** ARC Informatique PcVue 12.0.0 through 16.3.3.

**Is there a fix for CVE-2026-1693?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-1693 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-1693?** Check whether you run ARC Informatique PcVue at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

PcVue versions 12.0.0 through 16.3.3 utilize the deprecated OAuth 2.0 Resource Owner Password Credentials (ROPC) grant type within the web services supporting WebVue, WebScheduler, TouchVue, and SnapVue. ROPC is considered insecure because it requires the client application to handle and transmit the user's cleartext credentials directly, increasing the risk of credential exposure and making it difficult to implement multi-factor authentication. A remote attacker could exploit this weak authentication architecture to intercept or steal user credentials. The vulnerability is categorized under CWE-477 (Use of Obsolete Function) and CWE-1390 (Weak Authentication). Users should upgrade to version 16.3.4 or later to mitigate this risk.

## Affected products

- ARC Informatique PcVue 12.0.0 through 16.3.3

## Timeline

- 2026-02-26: disclosed
- 2026-02-26: advisory

## References

- [https://www.pcvue.com/security/](https://www.pcvue.com/security/)

## Related threats

- [ARC Informatique PcVue Inadequate Encryption Strength in User Directory](https://junglewise.ai/threats/cve-2026-14868-arc-informatique-pcvue-inadequate-encryption-strength-in-user)
- [ARC Informatique PcVue plaintext storage of credentials in User directory](https://junglewise.ai/threats/cve-2026-14867-arc-informatique-pcvue-plaintext-storage-of-credentials-in-user)
- [ARC Informatique PcVue HTTP Host header attack in WebClient and WebScheduler](https://junglewise.ai/threats/cve-2026-1698-arc-informatique-pcvue-http-host-header-attack-in-webclient-and)
- [ARC Informatique PcVue missing cookie attributes in WebClient](https://junglewise.ai/threats/cve-2026-1697-arc-informatique-pcvue-missing-cookie-attributes-in-webclient)
- [ARC Informatique PcVue Improper HTTP Security Headers](https://junglewise.ai/threats/cve-2026-1696-arc-informatique-pcvue-improper-http-security-headers)