CVE-2026-1697: PcVue XSS Vulnerability in Web Services

CVE-2026-1697 Overview

CVE-2026-1697 is a session management vulnerability affecting the GraphicalData web services and WebClient web application components of PcVue SCADA software. The vulnerability stems from missing Secure and SameSite cookie attributes, which could allow attackers to intercept or manipulate session cookies under certain conditions, potentially leading to session hijacking or cross-site request forgery attacks.

Critical Impact

Missing cookie security attributes in PcVue's web components expose industrial control system interfaces to potential session-based attacks, creating risk for critical infrastructure environments.

Affected Products

• PcVue version 12.0.0 through 16.3.3 (inclusive)
• PcVue GraphicalData Web Services
• PcVue WebClient Web Application

Discovery Timeline

• 2026-02-26 - CVE CVE-2026-1697 published to NVD
• 2026-02-26 - Last updated in NVD database

Technical Details for CVE-2026-1697

Vulnerability Analysis

This vulnerability is classified under CWE-614 (Sensitive Cookie in HTTPS Session Without 'Secure' Attribute). The absence of proper cookie security attributes in PcVue's web components creates conditions where session cookies may be transmitted over unencrypted connections or be vulnerable to cross-site request forgery attacks.

When web applications fail to set the Secure flag on cookies, browsers may transmit those cookies over unencrypted HTTP connections, even if the application is served over HTTPS. Similarly, the absence of the SameSite attribute allows cookies to be sent with cross-origin requests, potentially enabling CSRF attacks where an attacker tricks an authenticated user's browser into making unauthorized requests.

In the context of industrial control systems like PcVue, which is used for SCADA and HMI applications, this vulnerability could allow attackers to hijack operator sessions or perform unauthorized actions against critical infrastructure components.

Root Cause

The root cause is improper session cookie configuration in the GraphicalData web services and WebClient web application. The application fails to set the Secure attribute, which would restrict cookie transmission to HTTPS connections only, and the SameSite attribute, which would control cross-origin request behavior for cookies.

Attack Vector

The vulnerability is exploitable over a network-based attack vector requiring user interaction. An attacker could exploit this vulnerability through several scenarios:

1. Man-in-the-Middle (MitM) Attack: If a user accesses the PcVue web interface and any request is made over HTTP (even accidentally), the session cookie could be intercepted by an attacker positioned on the network path.

2. Cross-Site Request Forgery (CSRF): An attacker could craft a malicious webpage that, when visited by an authenticated PcVue user, triggers unauthorized requests to the PcVue interface using the victim's session cookies.

The vulnerability does not require prior authentication to exploit, though an authenticated victim session is required for the attack to have meaningful impact.

Detection Methods for CVE-2026-1697

Indicators of Compromise

• Unusual cross-origin requests to PcVue GraphicalData or WebClient endpoints
• HTTP (non-HTTPS) traffic containing session cookies for PcVue web services
• Unexpected administrative actions in PcVue audit logs that correlate with user browsing activity on untrusted sites
• Session tokens appearing in network traffic captures over unencrypted channels

Detection Strategies

• Configure web application firewalls to monitor for suspicious cross-origin requests to PcVue endpoints
• Implement network monitoring to detect any HTTP (non-HTTPS) traffic to PcVue web services
• Review browser console logs and server-side access logs for unusual request patterns indicative of CSRF attempts
• Deploy endpoint detection capabilities to identify potential MitM positioning on networks serving PcVue infrastructure

Monitoring Recommendations

• Enable detailed logging on PcVue web services to track all authentication and session-related events
• Monitor for session cookie transmission over non-HTTPS connections using network analysis tools
• Implement anomaly detection for user behavior patterns that may indicate session hijacking
• Review referrer headers in web server logs to identify potential CSRF attack attempts

How to Mitigate CVE-2026-1697

Immediate Actions Required

• Upgrade PcVue to a version newer than 16.3.3 that includes the security fix
• Ensure all PcVue web services are accessed exclusively over HTTPS with HTTP Strict Transport Security (HSTS) enabled
• Implement network segmentation to limit access to PcVue web interfaces from trusted networks only
• Configure reverse proxies or load balancers in front of PcVue to add Secure and SameSite cookie attributes at the network edge if immediate patching is not possible

Patch Information

The vendor has released a security bulletin addressing this vulnerability. Refer to the PCVue Security Bulletin SB2026-2 for detailed patch information and updated software versions that remediate this issue.

Organizations should prioritize applying the patch, especially in environments where PcVue is used for critical infrastructure monitoring and control.

Workarounds

• Deploy a reverse proxy (such as NGINX or Apache) in front of PcVue web services configured to inject Secure and SameSite=Strict attributes on all Set-Cookie headers
• Enforce HTTPS-only access using network-level controls and firewall rules to block HTTP traffic to PcVue services
• Restrict access to PcVue web interfaces to internal networks only, minimizing exposure to external attack vectors
• Implement additional authentication factors for PcVue web access to reduce impact of potential session compromise

# Example NGINX reverse proxy configuration to add cookie security attributes
# Add to location block serving PcVue web services
proxy_cookie_flags ~ secure samesite=strict;

# Alternatively, use header manipulation
proxy_hide_header Set-Cookie;
add_header Set-Cookie $sent_http_set_cookie;
more_set_headers -s 200 "Set-Cookie: $sent_http_set_cookie; Secure; SameSite=Strict";