CVE-2026-1696 - Vulnerability Details - OpenCVE

Some HTTP security headers are not properly set by the web server when sending responses to the client application.

Attack Vector Network

Attack Complexity High

Privileges Required None

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact Low

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Vendors	Products
Arcinfo	Pcvue

No data.

No data.

No data.

References

Link	Providers
https://www.pcvue.com/security/#SB2026-2

History

Thu, 26 Feb 2026 08:15:00 +0000

Type	Values Removed	Values Added
Description		Some HTTP security headers are not properly set by the web server when sending responses to the client application.
Title		Missing security HTTP headers
First Time appeared		Arcinfo Arcinfo pcvue
Weaknesses		CWE-79
CPEs		cpe:2.3:a:arcinfo:pcvue:::::::: cpe:2.3:a:arcinfo:pcvue:12.0.0:::::::*
Vendors & Products		Arcinfo Arcinfo pcvue
References		https://www.pcvue.com/security/#SB2026-2
Metrics		cvssV4_0 `{'score': 2.3, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/AU:Y/R:U/RE:M/U:Clear'}`

MITRE

Status: PUBLISHED

Assigner: arcinfo

Published: 2026-02-26T07:57:29.109Z

Updated: 2026-02-26T07:57:29.109Z

Reserved: 2026-01-30T08:38:07.602Z

Link: CVE-2026-1696

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-02-26T08:16:19.323

Modified: 2026-02-26T08:16:19.323

Link: CVE-2026-1696

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1696", "assignerOrgId": "87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932", "state": "PUBLISHED", "assignerShortName": "arcinfo", "dateReserved": "2026-01-30T08:38:07.602Z", "datePublished": "2026-02-26T07:57:29.109Z", "dateUpdated": "2026-02-26T07:57:29.109Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "modules": ["WebVue", "WebScheduler", "TouchVue", "SnapVue", "Web services"], "product": "PcVue", "vendor": "arcinfo", "versions": [{"lessThanOrEqual": "16.3.3", "status": "affected", "version": "16.0.0", "versionType": "cpe"}, {"lessThanOrEqual": "15.2.13", "status": "affected", "version": "15.0.0", "versionType": "cpe"}, {"status": "affected", "version": "12.0.0", "versionType": "cpe"}]}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:arcinfo:pcvue:*:*:*:*:*:*:*:*", "versionEndIncluding": "16.3.3", "versionStartIncluding": "16.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:arcinfo:pcvue:*:*:*:*:*:*:*:*", "versionEndIncluding": "15.2.13", "versionStartIncluding": "15.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:arcinfo:pcvue:12.0.0:*:*:*:*:*:*:*", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "OR"}], "datePublic": "2026-02-25T23:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Some HTTP security headers are not properly set by the web server when sending responses to the client application.<br>"}], "value": "Some HTTP security headers are not properly set by the web server when sending responses to the client application."}], "exploits": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "No POC available."}], "value": "No POC available."}, {"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Not known to be exploited"}], "value": "Not known to be exploited"}], "metrics": [{"cvssV4_0": {"Automatable": "YES", "Recovery": "USER", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 2.3, "baseSeverity": "LOW", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "CLEAR", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/AU:Y/R:U/RE:M/U:Clear", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "MODERATE"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"other": {"content": {"options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CNA", "version": "2.0.3"}, "type": "ssvc"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932", "shortName": "arcinfo", "dateUpdated": "2026-02-26T07:57:29.109Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://www.pcvue.com/security/#SB2026-2"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<b></b>\n\n<b>Harden the configuration</b><br><u>Who should apply this recommendation:</u> All users<br>\n\nTo reduce the risk of exploitation, ARC Informatique strongly recommends implementing the following defensive measures:\n\n<ul><li>Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from insecure networks.</li><li>Locate control system networks and remote devices behind firewalls and isolate them from business networks.</li><li>When remote access is required, use secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as its connected devices.</li></ul><br><b>Uninstall the Web Server</b> <br><u>Who should apply this recommendation:</u> All users <b>not </b>using the affected component <br><br>If your system does not require the use of the Web & Mobile features, you should make sure not to install them. If your system requires the use of the Web & Mobile features, they should be installed only on the Web Server.<br>See the product help related to the installation for more information.\n\n<br><br><br><b>Update IIS configuration \u2013 manually update HTTP headers</b><br><u>Who should apply this recommendation:</u> \n\nAll users running affected components.\n\n<br><br>As a quick mitigation for the unnecessary and missing HTTP headers, you can disable default headers and add secure HTTP headers for all requests. Those options can be set via the web.config file located on the IIS by following those steps:<br><ol><li>Open the file <i>C:\\inetpub\\<SV Website>\\web.config</i></li><li>Add the following entries to the section <i>customHeaders</i>, which are the recommendations from the official OWASP site:<br><remove name=\"X-Powered-By\" /><br><add name=\"X-Frame-Options\" value=\"DENY\" /><br><add name=\"X-XSS-Protection\" value=\"0\" /><br><add name=\"X-Content-Type-Options\" value=\"nosniff\" /><br><add name=\"X-DNS-Prefetch-Control\" value=\"off\" /><br><add name=\"Cross-Origin-Opener-Policy\" value=\"same-origin\" /><br><add name=\"Cross-Origin-Embedder-Policy\" value=\"require-corp\" /><br><add name=\"Cross-Origin-Resource-Policy\" value=\"same-site\" /><br><add name=\"Referrer-Policy\" value=\"strict-origin-when-cross-origin\" /><br><add name=\"Strict-Transport-Security\" value=\"max-age=63072000; includeSubDomains; preload\" /><br><add name=\"Permissions-Policy\" value=\"geolocation=(), camera=(), microphone=()\" /></li></ol><br><br><b></b>\n\n<b>Update the Web Deployment Console (WDC) and re deploy the Web Server</b><br><u>Who should apply this recommendation:</u> \n\nAll users running affected components.\n\n<br><br>Install a patched release of the Web Deployment Console (WDC) on the IIS Web server and use it to re-deploy the Web Site. Some settings might need to be updated if third-party web apps or services depend on the OAuth ROPC flow.<br><br>In a patched release of the WDC, new settings are available for each authorized Client to enable or disable:<br><ul><li>The Authorization Code flow</li><li>The Authorization Code flow with PKCE</li><li>The Resource Owner Password Credentials (ROPC) flow</li></ul>By default, all the OAuth flows are now disabled for third-party web apps and need to be manually enabled before deployment if required.<br><br>To verify that the patch is applied correctly, you must check that:<br><ul><li>The <i>File version</i> property of the file <i>./bin/Modules/WebDeployment/WebDeploymentConsole.exe</i> matches the deployed release or later, and ensure that any earlier release is no longer used;</li><li>Web Sites have been redeployed;</li><li>OAuth flow are correctly set for each authorized Client.</li></ul><br>\n\n<b>Available patches:</b><br>Patch provided in:<br><ul><li>PcVue 16.3.4 (16.3.4902.3112)</li></ul>Patch planned in:<br><ul><li>PcVue 15.2.14</li></ul>"}], "value": "Harden the configuration\nWho should apply this recommendation: All users\n\n\nTo reduce the risk of exploitation, ARC Informatique strongly recommends implementing the following defensive measures:\n\n * Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from insecure networks.\n * Locate control system networks and remote devices behind firewalls and isolate them from business networks.\n * When remote access is required, use secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as its connected devices.\n\n\n\nUninstall the Web Server \nWho should apply this recommendation: All users not using the affected component \n\nIf your system does not require the use of the Web & Mobile features, you should make sure not to install them. If your system requires the use of the Web & Mobile features, they should be installed only on the Web Server.\nSee the product help related to the installation for more information.\n\n\n\n\nUpdate IIS configuration \u2013 manually update HTTP headers\nWho should apply this recommendation: \n\nAll users running affected components.\n\n\n\nAs a quick mitigation for the unnecessary and missing HTTP headers, you can disable default headers and add secure HTTP headers for all requests. Those options can be set via the web.config file located on the IIS by following those steps:\n * Open the file C:\\inetpub\\<SV Website>\\web.config\n * Add the following entries to the section customHeaders, which are the recommendations from the official OWASP site:\n<remove name=\"X-Powered-By\" />\n<add name=\"X-Frame-Options\" value=\"DENY\" />\n<add name=\"X-XSS-Protection\" value=\"0\" />\n<add name=\"X-Content-Type-Options\" value=\"nosniff\" />\n<add name=\"X-DNS-Prefetch-Control\" value=\"off\" />\n<add name=\"Cross-Origin-Opener-Policy\" value=\"same-origin\" />\n<add name=\"Cross-Origin-Embedder-Policy\" value=\"require-corp\" />\n<add name=\"Cross-Origin-Resource-Policy\" value=\"same-site\" />\n<add name=\"Referrer-Policy\" value=\"strict-origin-when-cross-origin\" />\n<add name=\"Strict-Transport-Security\" value=\"max-age=63072000; includeSubDomains; preload\" />\n<add name=\"Permissions-Policy\" value=\"geolocation=(), camera=(), microphone=()\" />\n\n\n\n\nUpdate the Web Deployment Console (WDC) and re deploy the Web Server\nWho should apply this recommendation: \n\nAll users running affected components.\n\n\n\nInstall a patched release of the Web Deployment Console (WDC) on the IIS Web server and use it to re-deploy the Web Site. Some settings might need to be updated if third-party web apps or services depend on the OAuth ROPC flow.\n\nIn a patched release of the WDC, new settings are available for each authorized Client to enable or disable:\n * The Authorization Code flow\n * The Authorization Code flow with PKCE\n * The Resource Owner Password Credentials (ROPC) flow\n\n\nBy default, all the OAuth flows are now disabled for third-party web apps and need to be manually enabled before deployment if required.\n\nTo verify that the patch is applied correctly, you must check that:\n * The File version property of the file ./bin/Modules/WebDeployment/WebDeploymentConsole.exe matches the deployed release or later, and ensure that any earlier release is no longer used;\n * Web Sites have been redeployed;\n * OAuth flow are correctly set for each authorized Client.\n\n\n\n\n\nAvailable patches:\nPatch provided in:\n * PcVue 16.3.4 (16.3.4902.3112)\n\n\nPatch planned in:\n * PcVue 15.2.14"}], "source": {"advisory": "SB2026-2", "discovery": "EXTERNAL"}, "title": "Missing security HTTP headers", "x_generator": {"engine": "Vulnogram 0.2.0"}}}}