The vulnerability CVE-2026-14868 in arcinfo PcVue involves inadequate encryption strength (CWE-326) used to protect the configuration of user accounts stored within the built-in user directory of PcVue projects. Versions prior to 17.0.0 use an encryption algorithm that does not provide sufficient protection. A local attacker with low privileges can exploit this weakness to modify existing user account configurations, potentially escalating their privileges to gain full access to the PcVue application. The CVSS 4.0 vector indicates local attack vector with low complexity, no user interaction, and high impact on confidentiality and integrity. No vendor advisory or patch information is currently provided.

A local attacker with limited privileges can exploit the weak encryption protecting user account configurations to alter these configurations. This can lead to privilege escalation, granting the attacker privileged access to the PcVue application. The impact affects confidentiality and integrity of user account data and the security of the application environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict local access to trusted users only and monitor for unauthorized configuration changes. Avoid deploying PcVue versions prior to 17.0.0 in sensitive environments if possible.