CVE-2026-14867

Credentials of built-in users are insecurely stored in the User directory of PcVue projects, all versions prior to 17.0.0. A local attacker could retrieve users’ credentials. Active Directory accounts are not affected by this vulnerability.

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.pcvue.com/security/#SB2026-5	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:arcinfo:pcvue:*:*:*:*:*:*:*:*

History

25 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Las credenciales de los usuarios integrados se almacenan de forma insegura en el directorio de usuario de los proyectos de PcVue, en todas las versiones anteriores a la 17.0.0. Un atacante local podría recuperar las credenciales de los usuarios. Las cuentas de Active Directory no se ven afectadas por esta vulnerabilidad.

Information

Published : 2026-07-07 10:16

Updated : 2026-10-25 20:10

NVD link : CVE-2026-14867

Mitre link : CVE-2026-14867

CVE.ORG link : CVE-2026-14867

JSON object : View

Products Affected

arcinfo

pcvue

CWE

CWE-256

Plaintext Storage of a Password

{"id": "CVE-2026-14867", "cveTags": [], "metrics": {"ssvcV203": [{"source": "87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932", "ssvcData": {"role": "CNA", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3"}}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-14867", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-07T12:08:53.050760Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.8}], "cvssMetricV40": [{"type": "Secondary", "source": "87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "USER", "baseScore": 6.8, "Automatable": "YES", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:X/RE:M/U:Amber", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "AMBER", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "MODERATE", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932", "affectedData": [{"vendor": "arcinfo", "product": "PcVue", "versions": [{"status": "affected", "version": "0", "lessThan": "17.0.0", "versionType": "cpe"}], "defaultStatus": "affected"}]}], "published": "2026-07-07T10:16:40.120", "references": [{"url": "https://www.pcvue.com/security/#SB2026-5", "tags": ["Vendor Advisory"], "source": "87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932", "description": [{"lang": "en", "value": "CWE-256"}]}], "descriptions": [{"lang": "en", "value": "Credentials of built-in users are insecurely stored in the User directory of PcVue projects, all\u00a0versions prior to 17.0.0. A local attacker could retrieve users\u2019 credentials.\u00a0\n\nActive Directory accounts are not affected by this vulnerability."}, {"lang": "es", "value": "Las credenciales de los usuarios integrados se almacenan de forma insegura en el directorio de usuario de los proyectos de PcVue, en todas las versiones anteriores a la 17.0.0. Un atacante local podr\u00eda recuperar las credenciales de los usuarios.\n\nLas cuentas de Active Directory no se ven afectadas por esta vulnerabilidad."}], "lastModified": "2026-10-25T20:10:00.147", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:arcinfo:pcvue:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "62062D62-40E8-496A-A847-6D864DDA46C9", "versionEndExcluding": "17.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932"}