VulnerabilityPublished 12 Jul 2023Updated 9 Jun 2025

CVE-2023-36266: An issue was discovered in Keeper Password Manager for Desktop version 16.10.2 (fixed in 17.2), and

Source CVE Database V5

Public exploit available (Exploit-DB) · fixed in 17.2 : patch affected systems as a priority.

Data as of 26 Oct 2026, 17:16 UTC

Severity

High

Rated High by the CNA (mitre) · No CVSS score from NVD or the CNA

EPSS: 0.7% chance of exploitation in 30 days – higher than 55% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in 17.2

Exploitation evidence

t = 0 is the CVE’s publication on cve.org

Disclosed: evidence found.
CVE published 12 Jul 2023
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: evidence found.
1 Exploit-DB entry, 16 days after disclosure
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

CVE ID reserved
by MITRE Corporation
21 Jun 2023, 21 days before disclosure
CVE published
on cve.org
12 Jul 2023, t = 0
First Exploit-DB entry (opens in a new tab)
Keeper Security desktop 16.10.2 & Browser Extension 16.5.4 - Password Dumping
28 Jul 2023, 16 days after disclosure

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Affected software

Product	Affected	Fixed in
n/a n/a	Affected <=16.10.2 <=16.5.4	Fixed in–

AI-suggested

European organizations should ensure that all Keeper Password Manager desktop clients and browser extensions are updated to version 17.2 or later, where this vulnerability is fixed. Beyond patching, organizations should implement strict endpoint security controls including application whitelisting, anti-malware solutions with memory scanning capabilities, and least privilege policies to limit local access rights. Employing hardware-based security features such as Trusted Platform Modules (TPM) and enabling full disk encryption can reduce the risk of memory scraping attacks. Regularly monitoring for unusual local access patterns and employing endpoint detection and response (EDR) tools can help detect exploitation attempts. Additionally, organizations should educate users about the risks of local device compromise and enforce policies that prevent installation of unauthorized software. For browser environments, limiting the number of extensions and ensuring browsers are kept up to date can mitigate memory management issues that contribute to data persistence. Finally, consider using multi-factor authentication (MFA) to reduce the impact of credential exposure.

Description

An issue was discovered in Keeper Password Manager for Desktop version 16.10.2 (fixed in 17.2), and the KeeperFill Browser Extensions version 16.5.4 (fixed in 17.2), allows local attackers to gain sensitive information via plaintext password storage in memory after the user is already logged in, and may persist after logout. NOTE: the vendor disputes this for two reasons: the information is inherently available during a logged-in session when the attacker can read from arbitrary memory locations, and information only remains available after logout because of memory-management limitations of web browsers (not because the Keeper technology itself is retaining the information).

Impact

For European organizations, this vulnerability poses a significant risk particularly in environments where endpoint security is not tightly controlled. If an attacker gains local access to a device—either physically or through malware—they could extract plaintext passwords from memory, potentially compromising multiple accounts managed by Keeper Password Manager. This could lead to unauthorized access to corporate resources, data breaches, and lateral movement within networks. The persistence of sensitive data in memory after logout increases the window of opportunity for attackers to harvest credentials. Organizations with high compliance requirements such as GDPR must consider the risk of credential exposure and the resulting potential for data breaches. The impact is especially critical for sectors with sensitive data such as finance, healthcare, and government institutions. However, the requirement for local access or malware presence somewhat limits the scope compared to remote vulnerabilities, but it still represents a serious threat in environments where endpoint compromise is a realistic scenario.

References

Community reviews

Loading reviews…

Exploitation evidence

Timeline

What to do

Affected software

Description

AI analysisMachine-generated, updated 10 Jul 2025, 19:19 UTC

Public exploits and detection1 Exploit-DB entry

Technical details

References

Community reviews

Related threats