# CVE-2026-1697: ARC Informatique PcVue missing cookie attributes in WebClient

Source: https://junglewise.ai/threats/cve-2026-1697-arc-informatique-pcvue-missing-cookie-attributes-in-webclient  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-02-26. Updated: 2026-07-09  
License: CC BY 4.0 with a link back

CVE-2026-1697 · Severity: medium · CVSS 6.5 · Published 2026-02-26

PcVue is a monitoring and control platform used in industrial environments like power plants and water systems. A security issue was found where certain web components do not use standard security flags for browser cookies. This could allow an attacker to potentially intercept or manipulate user sessions, leading to unauthorized access to the monitoring interface.

Technologies: [ARC Informatique PcVue](https://junglewise.ai/threats/technologies/pcvue). Vendors: [ARC Informatique](https://junglewise.ai/threats/vendors/arc-informatique).

## Quick answers

**Is CVE-2026-1697 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-1697 being exploited in the wild.

**How severe is CVE-2026-1697?** Medium severity, with a CVSS score of 6.5, published 26 February 2026.

**Which products and versions are affected?** ARC Informatique PcVue 12.0.0 through 16.3.3.

**Is there a fix for CVE-2026-1697?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-1697 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-1697?** Check whether you run ARC Informatique PcVue at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

PcVue versions 12.0.0 through 16.3.3 are vulnerable to cookie security attribute omissions (CWE-614 and CWE-1275). Specifically, the GraphicalData web services and WebClient web application do not implement the 'Secure' attribute, which ensures cookies are only sent over encrypted connections, nor the 'SameSite' attribute, which helps prevent Cross-Site Request Forgery (CSRF). An unauthenticated remote attacker could potentially capture session cookies over unencrypted channels or perform cross-site attacks to gain unauthorized access to the web interface. The vendor has addressed this in version 16.3.4 and other subsequent updates.

## Affected products

- ARC Informatique (arcinfo) PcVue 12.0.0 through 16.3.3

## Timeline

- 2026-02-26: disclosed
- 2026-02-26: advisory: Vendor advisory SB2026-2 published

## References

- [https://www.pcvue.com/security/](https://www.pcvue.com/security/)

## Related threats

- [ARC Informatique PcVue Inadequate Encryption Strength in User Directory](https://junglewise.ai/threats/cve-2026-14868-arc-informatique-pcvue-inadequate-encryption-strength-in-user)
- [ARC Informatique PcVue plaintext storage of credentials in User directory](https://junglewise.ai/threats/cve-2026-14867-arc-informatique-pcvue-plaintext-storage-of-credentials-in-user)
- [ARC Informatique PcVue HTTP Host header attack in WebClient and WebScheduler](https://junglewise.ai/threats/cve-2026-1698-arc-informatique-pcvue-http-host-header-attack-in-webclient-and)
- [ARC Informatique PcVue Improper HTTP Security Headers](https://junglewise.ai/threats/cve-2026-1696-arc-informatique-pcvue-improper-http-security-headers)
- [ARC Informatique PcVue XSS in OAuth web services](https://junglewise.ai/threats/cve-2026-1695-arc-informatique-pcvue-xss-in-oauth-web-services)