PT-2026-22125 · Pcvue+4 · Pcvue+4

Published 2026-02-26 · Updated 2026-03-12 · CVE-2026-1693

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions PcVue versions 12.0.0 through 16.3.3

Description The OAuth grant type Resource Owner Password Credentials (ROPC) flow is still utilized by the web services supporting the WebVue, WebScheduler, TouchVue, and Snapvue features. This practice, despite the flow being deprecated, could enable a remote attacker to obtain user credentials.

Recommendations Versions 12.0.0 through 16.3.3 should discontinue the use of the Resource Owner Password Credentials (ROPC) OAuth grant type flow for the WebVue, WebScheduler, TouchVue, and Snapvue features.

Fix

Weakness Enumeration

CWE-477

CWE-1390

Related Identifiers

CVE-2026-1693

Affected Products

Pcvue

Snapvue

Touchvue

Web Schedule

Webvue

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-1693 · Security Note
• https://osv.dev/vulnerability/CVE-2026-1693 · Vendor Advisory
• https://pcvue.com/security/#SB2026-2 · Vendor Advisory
• https://t.me/CVEtracker/45833 · Telegram Post
• https://twitter.com/dailycve/status/2032178072527511730 · Twitter Post
• https://twitter.com/CVEnew/status/2027004192557093077 · Twitter Post
• https://t.me/cveNotify/153298 · Telegram Post
• https://t.me/cveNotify/155269 · Telegram Post