CVE-2026-14867 describes a vulnerability in arcinfo's PcVue product where credentials of built-in users are stored insecurely in plaintext in the User directory of PcVue projects for all versions prior to 17.0.0. This allows a local attacker with appropriate access to retrieve user credentials. Active Directory accounts are not impacted by this vulnerability. There is no vendor advisory or patch information available at this time.

The vulnerability allows local attackers to obtain plaintext credentials of built-in users, potentially leading to unauthorized access to the affected system. Since Active Directory accounts are not affected, the impact is limited to non-AD built-in user accounts. The CVSS 4.0 score is 6.8 (medium severity), reflecting the local attack vector and the requirement for low privileges but no user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict local access to systems running vulnerable versions of PcVue and consider using Active Directory accounts where possible, as they are not affected by this vulnerability.