Answer in brief
CVE-2026-1698 records a Medium severity (CVSS 6.1) vulnerability in HTTP Host header vulnerability in WebClient and WebScheduler web apps. The current sources do not mark it as known exploited. The current feed maps arcinfo/PcVue (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 6.1. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps arcinfo/PcVue (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| arcinfo/PcVuegeneric | 16.0.0 || 15.0.0 | Not reported |
Published upstream
Feb 26, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Jul 9, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jul 9, 2026
A HTTP Host header attack vulnerability affects WebClient and the WebScheduler web apps of PcVue in version 15.0.0 through 16.3.3 included, allowing a remote attacker to inject harmful payloads that manipulate server-side behavior. This vulnerability only affects the endpoints /Authentication/ExternalLogin, /Authentication/AuthorizationCodeCallback and /Authentication/Logout of the WebClient and WebScheduler web apps.
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2026-1698 records a Medium severity (CVSS 6.1) vulnerability in HTTP Host header vulnerability in WebClient and WebScheduler web apps. The current sources do not mark it as known exploited. The current feed maps arcinfo/PcVue (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 6.1. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps arcinfo/PcVue (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| arcinfo/PcVuegeneric | 16.0.0 || 15.0.0 | Not reported |
Published upstream
Feb 26, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Jul 9, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jul 9, 2026
A HTTP Host header attack vulnerability affects WebClient and the WebScheduler web apps of PcVue in version 15.0.0 through 16.3.3 included, allowing a remote attacker to inject harmful payloads that manipulate server-side behavior. This vulnerability only affects the endpoints /Authentication/ExternalLogin, /Authentication/AuthorizationCodeCallback and /Authentication/Logout of the WebClient and WebScheduler web apps.
Quoted source text, attributed separately from HOL analysis.