CVE-2026-75137: Cleartext Storage of Sensitive Information in Memory in Septeo IT Solutions UpSignOn
Description
UpSignOn for Windows before 7.19.0 contains a sensitive data exposure vulnerability that allows local attackers to recover cleartext vault data from process memory even after the application has been locked. Attackers can use the PROCESS_VM_READ permission to read the memory space of UpSignOn.exe and extract sensitive fields including entry names, URLs, usernames, passwords, TOTP secrets, and notes.
CVSS v4.0
Score 6.9medium
Affected software
Septeo IT Solutions
UpSignOn
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-75137 describes a sensitive data exposure vulnerability in Septeo IT Solutions' UpSignOn for Windows prior to version 7.19.0. The flaw allows local attackers with PROCESS_VM_READ permission to read the memory space of the UpSignOn.exe process and recover cleartext vault data despite the application being locked. Extracted data includes entry names, URLs, usernames, passwords, TOTP secrets, and notes, indicating that sensitive information is not properly cleared or encrypted in memory after locking.
Potential Impact
Local attackers with the ability to read process memory can obtain sensitive authentication and vault data, potentially compromising user credentials and two-factor authentication secrets. This exposure could lead to unauthorized access to user accounts and confidential information stored within UpSignOn.
Mitigation Recommendations
No official patch or remediation guidance is currently available. Users should monitor the vendor advisory for updates and consider restricting local PROCESS_VM_READ permissions to trusted users only to reduce risk until a fix is released.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-08-17T18:39:57.661Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a987783acd9273b49a1b436
Added to database: 09/02/2026, 19:22:43 UTC
Last enriched: 09/07/2026, 13:08:58 UTC
Last updated: 10/17/2026, 06:48:20 UTC
Views: 92
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.