CVE-2026-1694lowCWE-201

CVE-2026-1694: low-severity vulnerability in arcinfo PcVue

Server configuration details in HTTP headers

Published · Updated

Follow this CVE+ Monitor PcVue

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

8Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 2.3epss 0.2%
HTTP headers are added by the default configuration of IIS and ASP.net, and are not removed at the deployment phase of the webservices used by the WebVue, WebScheduler, TouchVue and SnapVue features of PcVue in version 12.0.0 through 16.3.3 included. It unnecessarily exposes sensitive information about the server configuration.
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/AU:Y/R:U/RE:M/U:Clear
Affected products
arcinfo · PcVue
Related CVEs — arcinfo PcVue

In the same product, most dangerous first.

CVE-2026-1693MEDIUMUse of vulnerable Resource Owner Password Credentials flowEPSS 0.4%CVE-2024-12056LOWClient Secret not checked with OAuth Password grant typeEPSS 0.4%CVE-2025-9998MEDIUMImproper validation of packets sequencingEPSS 0.3%CVE-2026-1698MEDIUMHTTP Host header vulnerability in WebClient and WebScheduler web appsEPSS 0.2%CVE-2026-1695MEDIUMXSS vulnerability upon unsuccessful authenticationEPSS 0.2%CVE-2026-1696LOWMissing security HTTP headersEPSS 0.2%