CVE-2026-14867: Arcinfo PcVue Credential Disclosure Flaw

CVE-2026-14867 Overview

CVE-2026-14867 is a credential storage vulnerability affecting Arcinfo PcVue supervisory control and data acquisition (SCADA) software. All versions prior to 17.0.0 store credentials of built-in users insecurely within the User directory of PcVue projects. A local attacker with access to the project directory can retrieve these credentials and impersonate valid users. Active Directory accounts integrated with PcVue are not affected by this weakness. The issue is tracked under [CWE-256] (Plaintext Storage of a Password) and requires local access with low privileges to exploit.

Critical Impact
Local attackers with access to PcVue project files can recover built-in user credentials, enabling unauthorized access to industrial control system operator accounts.

Affected Products

Arcinfo PcVue — all versions prior to 17.0.0
PcVue projects containing built-in (non-Active Directory) user accounts
SCADA deployments relying on local PcVue authentication

Discovery Timeline

2026-07-07 - CVE-2026-14867 published to NVD
2026-07-09 - Last updated in NVD database

Technical Details for CVE-2026-14867

Vulnerability Analysis

The vulnerability resides in how PcVue persists built-in user credentials on disk. Credentials are written to files inside the User directory of each PcVue project without adequate cryptographic protection. Any local user with read access to the project directory can obtain the stored authentication material. The confidentiality impact is high because compromised credentials grant operator or administrator access to the SCADA runtime. Integrity and availability of the vulnerable component are not directly affected by the disclosure itself, though follow-on actions using the recovered credentials can affect industrial processes.

EPSS data reports a low near-term exploitation probability, but the vulnerability class is well understood and trivial to leverage once file access is obtained. Active Directory-based authentication paths remain unaffected, which limits exposure in environments that have migrated built-in accounts to centralized identity providers.

Root Cause

The root cause is plaintext or insufficiently protected storage of authentication secrets [CWE-256] in the project's User directory. PcVue relies on filesystem permissions rather than strong cryptographic protection to guard credential material. When a local actor can read those files, the credentials are recoverable without further exploitation.

Attack Vector

Exploitation requires local access to the host storing PcVue project files with at least low-privileged user rights. The attacker locates the User directory within the project tree and reads the credential files. No user interaction is required and the attack complexity is low. The attacker then reuses the recovered credentials to authenticate to PcVue services or clients that accept built-in user accounts.

No public proof-of-concept, exploit code, or CISA KEV listing is currently associated with this CVE. Refer to the PCVue Security Bulletin SB2026-5 for vendor-provided technical context.

Detection Methods for CVE-2026-14867

Indicators of Compromise

Unexpected read access to files under the PcVue project User directory by non-administrative accounts.
Successful PcVue logins from workstations or user contexts that do not normally operate the SCADA environment.
Copy or archive operations targeting PcVue project folders by processes unrelated to engineering workstations.

Detection Strategies

Enable filesystem auditing on PcVue project directories and alert on read events against the User subfolder.
Correlate PcVue application authentication logs with endpoint process telemetry to identify credential reuse from unusual hosts.
Baseline which service accounts and engineering users legitimately access the project directory and flag deviations.

Monitoring Recommendations

Forward PcVue authentication events and Windows Security event logs to a centralized SIEM for correlation.
Monitor for archive utilities (7z.exe, zip.exe, robocopy.exe) executing against PcVue installation paths.
Track logon activity for built-in PcVue accounts and compare against expected operator schedules.

How to Mitigate CVE-2026-14867

Immediate Actions Required

Upgrade PcVue to version 17.0.0 or later as published in the vendor security bulletin.
Restrict NTFS permissions on PcVue project directories so only required engineering and service accounts hold read access.
Rotate all built-in PcVue account passwords after upgrading, assuming prior credentials may have been exposed.

Patch Information

Arcinfo addresses CVE-2026-14867 in PcVue 17.0.0. Consult the PCVue Security Bulletin SB2026-5 for release notes, patch packages, and vendor guidance on upgrading production SCADA environments.

Workarounds

Migrate built-in PcVue user accounts to Active Directory authentication, which the advisory confirms is not affected.
Store PcVue projects on volumes with full-disk encryption and enforce least-privilege access controls on the host.
Isolate PcVue engineering workstations on segmented OT networks and disable interactive local logon for non-operator accounts.

bash

# Configuration example: restrict access to the PcVue project User directory (Windows)
icacls "C:\PcVueProjects\<ProjectName>\User" /inheritance:r
icacls "C:\PcVueProjects\<ProjectName>\User" /grant:r "Administrators:(OI)(CI)F" "PcVueService:(OI)(CI)M"
icacls "C:\PcVueProjects\<ProjectName>\User" /remove "Users" "Authenticated Users"