CVE-2026-75136: Insufficiently Protected Credentials in Septeo IT Solutions UpSignOn

CVE-2026-75136 describes an insecure credential storage vulnerability in UpSignOn for Windows prior to version 7.19.0. The biometric unlock key is stored in the Windows PasswordVault API but can be retrieved by local attackers without triggering any authentication prompt. This enables attackers with local access and low privileges within the same Windows session to decrypt the protected vault files and export the entire password manager contents in cleartext. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity, with low attack complexity and no user interaction required.

An attacker with local access and low privileges on the affected system can retrieve the biometric unlock key without authentication, decrypt the vault files, and export all stored passwords in cleartext. This compromises the confidentiality of all credentials managed by UpSignOn, potentially leading to further local or network attacks using the exposed credentials.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict local access to trusted users only and consider additional endpoint protection measures to prevent unauthorized local process execution.