# CVE-2026-1694: ARC Informatique PcVue Information Exposure via Default HTTP Headers

Source: https://junglewise.ai/threats/cve-2026-1694-arc-informatique-pcvue-information-exposure-via-default-http  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-02-26. Updated: 2026-07-09  
License: CC BY 4.0 with a link back

CVE-2026-1694 · Severity: medium · CVSS 4.3 · Published 2026-02-26

PcVue, a platform used for monitoring industrial and building automation systems, contains a configuration oversight in its web-based components. The default setup fails to remove certain technical information from the server's responses, which can reveal details about the underlying software environment to unauthorized users. While this does not directly allow for a system takeover, it provides attackers with reconnaissance data that could be used to plan more sophisticated targeted attacks.

Technologies: [ARC Informatique PcVue](https://junglewise.ai/threats/technologies/pcvue). Vendors: [ARC Informatique](https://junglewise.ai/threats/vendors/arc-informatique).

## Quick answers

**Is CVE-2026-1694 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-1694 being exploited in the wild.

**How severe is CVE-2026-1694?** Medium severity, with a CVSS score of 4.3, published 26 February 2026.

**Which products and versions are affected?** ARC Informatique PcVue 12.0.0 through 16.3.3.

**Is there a fix for CVE-2026-1694?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-1694 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-1694?** Check whether you run ARC Informatique PcVue at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

PcVue (versions 12.0.0 to 16.3.3) suffers from an information exposure vulnerability (CWE-201) due to insecure default configurations in its web services components, including WebVue, WebScheduler, TouchVue, and SnapVue. The application fails to strip default IIS and ASP.NET HTTP headers (such as 'X-Powered-By' or 'Server') during the deployment phase. A remote, unauthenticated attacker can observe these headers in HTTP responses to gain technical intelligence about the server's environment and versioning. This reconnaissance data can facilitate the identification of further vulnerabilities specific to the underlying stack. The issue is addressed in version 16.3.4 and later.

## Affected products

- ARC Informatique (arcinfo) PcVue 12.0.0 through 16.3.3

## Timeline

- 2026-02-26: disclosed
- 2026-02-26: advisory

## References

- [https://www.pcvue.com/security/](https://www.pcvue.com/security/)

## Related threats

- [ARC Informatique PcVue Inadequate Encryption Strength in User Directory](https://junglewise.ai/threats/cve-2026-14868-arc-informatique-pcvue-inadequate-encryption-strength-in-user)
- [ARC Informatique PcVue plaintext storage of credentials in User directory](https://junglewise.ai/threats/cve-2026-14867-arc-informatique-pcvue-plaintext-storage-of-credentials-in-user)
- [ARC Informatique PcVue HTTP Host header attack in WebClient and WebScheduler](https://junglewise.ai/threats/cve-2026-1698-arc-informatique-pcvue-http-host-header-attack-in-webclient-and)
- [ARC Informatique PcVue missing cookie attributes in WebClient](https://junglewise.ai/threats/cve-2026-1697-arc-informatique-pcvue-missing-cookie-attributes-in-webclient)
- [ARC Informatique PcVue Improper HTTP Security Headers](https://junglewise.ai/threats/cve-2026-1696-arc-informatique-pcvue-improper-http-security-headers)