Is CVE-2026-1694 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-1694 being exploited in the wild.

How severe is CVE-2026-1694?

Medium severity, with a CVSS score of 4.3, published 26 February 2026.

Which products and versions are affected?

ARC Informatique PcVue 12.0.0 through 16.3.3.

Is there a fix for CVE-2026-1694?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-1694 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-1694?

Check whether you run ARC Informatique PcVue at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-1694: ARC Informatique PcVue Information Exposure via Default HTTP Headers

CVE-2026-1694 · Severity: medium · CVSS 4.3 · Published 2026-02-26

PcVue, a platform used for monitoring industrial and building automation systems, contains a configuration oversight in its web-based components. The default setup fails to remove certain technical information from the server's responses, which can reveal details about the underlying software environment to unauthorized users. While this does not directly allow for a system takeover, it provides attackers with reconnaissance data that could be used to plan more sophisticated targeted attacks.

Technologies: ARC Informatique PcVue. Vendors: ARC Informatique.

Quick answers

Is CVE-2026-1694 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-1694 being exploited in the wild.
How severe is CVE-2026-1694?: Medium severity, with a CVSS score of 4.3, published 26 February 2026.
Which products and versions are affected?: ARC Informatique PcVue 12.0.0 through 16.3.3.
Is there a fix for CVE-2026-1694?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-1694 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-1694?: Check whether you run ARC Informatique PcVue at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

PcVue (versions 12.0.0 to 16.3.3) suffers from an information exposure vulnerability (CWE-201) due to insecure default configurations in its web services components, including WebVue, WebScheduler, TouchVue, and SnapVue. The application fails to strip default IIS and ASP.NET HTTP headers (such as 'X-Powered-By' or 'Server') during the deployment phase. A remote, unauthenticated attacker can observe these headers in HTTP responses to gain technical intelligence about the server's environment and versioning. This reconnaissance data can facilitate the identification of further vulnerabilities specific to the underlying stack. The issue is addressed in version 16.3.4 and later.

Affected products

ARC Informatique (arcinfo) PcVue 12.0.0 through 16.3.3

Timeline

2026-02-26: disclosed
2026-02-26: advisory

References

https://www.pcvue.com/security/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.