CVE-2026-75135

Medium

Description

UpSignOn for Windows before 7.19.0 contains a sensitive data exposure vulnerability that allows local attackers to recover the master password and decrypt vault contents by reading a retained backup key from the process memory of UpSignOn.exe, even after the vault has been re-locked. Attackers can extract the backup key from process memory to decrypt the encrypted master password backup stored in v6-vault1.DATA.txt, then use the recovered master password to decrypt the main vault and export all password manager entries in cleartext.

SeverityMedium

CVSS6.1

Exploit probability1. percentile0.1%

ProductUpSignOn

PublishedSep 2, 2026

First seenSep 2, 2026

Weakness typeCWE-316CWE-316

How to fix

Update

Septeo IT Solutions UpSignOn7.19.0 or later

Vendor advisories

upsignon.eu/en/resources/release-notes/app#7.19.0

Affected products

Product	Affected versions	Fixed in
Septeo IT Solutions UpSignOn	v < 7.19.0	7.19.0

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.