Security readout for executives and security teams
Plain-English summary
PcVue’s GraphicalData web service and WebClient app set cookies without important browser protections. This can make user sessions easier to expose or misuse in certain web scenarios. The issue is rated medium and requires user interaction, but it matters for environments where PcVue web access supports operational monitoring or control workflows.
Executive priority
Treat as a planned remediation item, not an emergency. Prioritize faster if PcVue web access is broadly reachable, used by privileged operators, or supports sensitive operational workflows. Confirm vendor guidance and reduce unnecessary web exposure.
Technical view
CVE-2026-1697 affects PcVue versions 12.0.0 through 16.3.3 inclusive. The GraphicalData web services and WebClient web app omit Secure and SameSite cookie attributes, mapped to CWE-1275 and CWE-614. CVSS v4.0 score is 5.3. The vector indicates network reachability, low attack complexity, no privileges, and required user interaction.
Likely exposure
Organizations running affected PcVue web components, especially where WebClient or GraphicalData is reachable by users over a network. Exposure is higher if web access is available beyond tightly controlled internal networks or if users access PcVue from general-purpose browsers.
Exploitation context
The supplied sources do not indicate active exploitation, and this CVE is not listed as KEV. Exploitation would depend on a user interaction scenario and vulnerable cookie handling. The impact is limited but can affect confidentiality and integrity of session-related data.
Researcher notes
The public record identifies the weakness and version range but does not include detailed patch information in the provided bundle. Avoid assuming exploitability beyond insecure cookie handling. Validation should focus on cookie attributes, reachable web components, and alignment with the vendor advisory.
Mitigation direction
- Review PcVue security advisory SB2026-2 for vendor-supported fixes or configuration guidance.
- Upgrade or patch affected PcVue deployments if the vendor advisory provides corrected versions.
- Restrict PcVue web access to trusted networks and authenticated users.
- Require HTTPS for PcVue web interfaces wherever supported.
- Monitor vendor communications for updated remediation details.
Validation and detection
- Inventory PcVue installations and confirm exact versions.
- Identify use of WebClient and GraphicalData web services.
- Check response cookies for missing Secure and SameSite attributes.
- Confirm whether affected web interfaces are reachable from untrusted networks.
- Document compensating controls until vendor remediation is applied.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-1275: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-614: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-1697 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.3 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/AU:Y/R:U/RE:M/U:Clear
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/AU:Y/R:U/RE:M/U:Clear——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
5.3MediumVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/AU:Y/R:U/RE:M/U:Clear
Source materials
- CVE List V5 sourceCVE List V5
- https://www.pcvue.com/security/#SB2026-2CVE reference · vendor-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Sensitive Cookie with Improper SameSite Attribute
Sensitive Cookie with Improper SameSite Attribute represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.