PcVue CVE-2026-14867

Exploitation requires a local OS session on the PcVue host with at least low-level privileges sufficient to read files in the PcVue project's User directory (PR:L per CVSS 4.0 vector). No network access, special configuration, or elevated OS privileges are required beyond this baseline filesystem read access. The vulnerability is strictly limited to PcVue built-in accounts - Active Directory-integrated accounts are explicitly unaffected, so deployments using only AD authentication have no exposure. Exploitation is further bounded to PcVue versions prior to 17.0.0 running on the local host; there is no remote or network-facing attack surface for this specific flaw.

The CVSS 4.0 score of 6.8 (Medium) with vector AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N reflects a local-only attack with high confidentiality impact but no integrity or availability impact. The low attack complexity and absence of special attack requirements (AT:N) mean that any low-privileged local user can reliably exploit this. However, the local-only attack vector (AV:L) is a significant limiting factor - there is no network-facing exploitation path. No CISA KEV listing exists and no POC is publicly known, indicating no confirmed active exploitation. EPSS data is not provided, but the local-only constraint suggests limited automated exploitation potential. In OT environments, the risk is elevated because credential reuse, lateral movement from a compromised workstation, or malicious insiders make local access more achievable than in typical enterprise contexts. The scope is further bounded to built-in accounts only, as Active Directory accounts are explicitly unaffected.

An attacker who has obtained low-privileged OS access to a PcVue workstation - via phishing, lateral movement, or a malicious insider - navigates to the PcVue project's User directory and reads the credential storage files. The attacker extracts plaintext or reversibly-encoded passwords for PcVue built-in operator or administrator accounts and authenticates to PcVue with elevated privileges, gaining the ability to modify SCADA setpoints, disable alarms, or exfiltrate process data. No public exploit code has been identified.