Is CVE-2026-1698 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-1698 being exploited in the wild.

How severe is CVE-2026-1698?

Medium severity, with a CVSS score of 6.1, published 26 February 2026.

Which products and versions are affected?

ARC Informatique PcVue 15.0.0 through 15.2.13, 16.0.0 through 16.3.3.

Is there a fix for CVE-2026-1698?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-1698 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-1698?

Check whether you run ARC Informatique PcVue at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-1698: ARC Informatique PcVue HTTP Host header attack in WebClient and WebScheduler

CVE-2026-1698 · Severity: medium · CVSS 6.1 · Published 2026-02-26

A security vulnerability exists in the WebClient and WebScheduler components of PcVue, a platform used for monitoring industrial and building automation systems. An attacker can send specially crafted web requests to manipulate how the server handles authentication and logout processes. This could lead to unauthorized redirection or the injection of malicious content, potentially compromising user sessions or misleading operators.

Technologies: ARC Informatique PcVue. Vendors: ARC Informatique.

Quick answers

Is CVE-2026-1698 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-1698 being exploited in the wild.
How severe is CVE-2026-1698?: Medium severity, with a CVSS score of 6.1, published 26 February 2026.
Which products and versions are affected?: ARC Informatique PcVue 15.0.0 through 15.2.13, 16.0.0 through 16.3.3.
Is there a fix for CVE-2026-1698?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-1698 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-1698?: Check whether you run ARC Informatique PcVue at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A HTTP Host header attack vulnerability (CWE-644) exists in the WebClient and WebScheduler web applications of PcVue. The issue stems from improper neutralization of the Host header in the /Authentication/ExternalLogin, /Authentication/AuthorizationCodeCallback, and /Authentication/Logout endpoints. A remote, unauthenticated attacker can exploit this by submitting a malicious Host header, allowing for the injection of harmful payloads that manipulate server-side behavior, such as password reset poisoning or web cache poisoning. The vulnerability is addressed in versions 15.2.14 and 16.3.4.

Affected products

ARC Informatique PcVue 15.0.0 through 15.2.13, 16.0.0 through 16.3.3

Timeline

2026-02-26: advisory: Initial publication of CVE-2026-1698
2026-02-26: disclosed: Vendor advisory SB2026-2 released

References

https://www.pcvue.com/security/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.