CVE-2026-75135: Cleartext Storage of Sensitive Information in Memory in Septeo IT Solutions UpSignOn

CVE-2026-75135 describes a sensitive data exposure vulnerability in Septeo IT Solutions' UpSignOn password manager for Windows prior to version 7.19.0. The vulnerability arises because a backup key remains in the process memory of UpSignOn.exe after the vault is re-locked. Local attackers with access to the system can read this retained backup key from memory, use it to decrypt the encrypted master password backup stored in the file v6-vault1.DATA.txt, and subsequently decrypt the main vault. This results in exposure of all password manager entries in cleartext.

An attacker with local access can recover the master password and decrypt all stored passwords in the vault, compromising the confidentiality of all sensitive credentials managed by UpSignOn. This undermines the security guarantees of the password manager and can lead to credential theft and further compromise of user accounts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or workaround has been documented at this time. Users should monitor for updates from Septeo IT Solutions and apply any forthcoming patches promptly. Until a fix is available, restricting local access to trusted users only is advised.