CVE-2026-75135: UpSignOn Windows Information Disclosure Flaw

CVE-2026-75135 Overview

CVE-2026-75135 is a sensitive data exposure vulnerability affecting UpSignOn for Windows versions before 7.19.0. The password manager retains a backup encryption key in the memory of the UpSignOn.exe process after the vault is re-locked. A local attacker with access to the process memory can extract this key, decrypt the encrypted master password backup stored in v6-vault1.DATA.txt, and then use the recovered master password to unlock the primary vault. The result is full disclosure of every credential stored in the password manager. The issue is tracked as [CWE-316: Cleartext Storage of Sensitive Information in Memory].

Critical Impact
Local attackers can recover the master password and export all stored password manager entries in cleartext, even after the user has re-locked the vault.

Affected Products

UpSignOn for Windows versions prior to 7.19.0
Local Windows installations of the UpSignOn desktop client
Vaults protected by the v6-vault1.DATA.txt backup format

Discovery Timeline

2026-09-02 - CVE-2026-75135 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-75135

Vulnerability Analysis

UpSignOn for Windows uses an encrypted backup mechanism to persist the master password in the file v6-vault1.DATA.txt. The key used to decrypt this backup is loaded into the memory of UpSignOn.exe during normal operation. The application fails to zeroize or otherwise purge this key when the vault is placed back into a locked state.

Because the backup key remains resident in process memory, a locked vault does not represent a meaningful security boundary against a local attacker with the ability to read that memory. Once the backup key is recovered, the attacker decrypts the master password and gains cleartext access to every entry in the vault.

Root Cause

The root cause is improper handling of cryptographic material in memory, categorized under [CWE-316]. Sensitive key material with the lifetime of a single unlock session is instead retained for the lifetime of the process. Re-locking the vault does not trigger secure wiping of the buffer holding the backup key.

Attack Vector

Exploitation requires local access with permission to read the memory of UpSignOn.exe. This includes the user's own session or another account with debug or memory-read privileges. Common paths include malware operating in the user context, credential-stealer tooling, or an attacker with interactive access to an unlocked workstation. No user interaction with UpSignOn is required after the initial unlock, and re-locking the vault does not mitigate the exposure.

The exploitation flow is described in prose only. See the VulnCheck Advisory on Upsignon for the technical write-up:

Read the memory of the UpSignOn.exe process to locate the retained backup key.
Use the extracted key to decrypt v6-vault1.DATA.txt and recover the master password.
Supply the master password to decrypt the main vault and export all entries in cleartext.

Detection Methods for CVE-2026-75135

Indicators of Compromise

Unexpected access to the v6-vault1.DATA.txt file outside of normal UpSignOn operations.
Processes other than UpSignOn.exe opening handles to UpSignOn.exe with PROCESS_VM_READ or debug rights.
Use of memory-dumping utilities such as procdump, Task Manager full memory dumps, or MiniDumpWriteDump calls targeting UpSignOn.exe.
Presence of credential-stealer binaries or scripts on hosts that also run UpSignOn.

Detection Strategies

Monitor for cross-process memory reads targeting UpSignOn.exe, particularly from non-signed or user-writable binaries.
Alert on file access to v6-vault1.DATA.txt by processes other than UpSignOn.exe.
Correlate execution of known dumping tools with subsequent file exfiltration events on endpoints where UpSignOn is installed.

Monitoring Recommendations

Enable command-line and process-creation logging on Windows endpoints running UpSignOn.
Track installed UpSignOn versions across the fleet and flag any host below 7.19.0.
Review authentication and endpoint telemetry for anomalous local logons that could precede memory-scraping activity.

How to Mitigate CVE-2026-75135

Immediate Actions Required

Upgrade UpSignOn for Windows to version 7.19.0 or later on all endpoints.
Rotate the master password and any credentials stored in the vault after upgrading, assuming prior local compromise cannot be ruled out.
Restrict local administrator and debug privileges on workstations that host UpSignOn.
Remove stale copies of v6-vault1.DATA.txt from backup locations that predate the fix.

Patch Information

UpSignOn addressed the sensitive key retention issue in release 7.19.0. Details are documented in the UpSignOn Release Notes 7.19.0. Administrators should deploy the update through standard software distribution channels and verify the installed version on each endpoint.

Workarounds

Terminate the UpSignOn.exe process after each use rather than relying on the in-application lock, which does not clear the backup key from memory.
Enforce full-disk encryption and screen-lock policies to reduce opportunities for local memory access.
Restrict which accounts can obtain SeDebugPrivilege on endpoints running UpSignOn.
Apply application-control policies to block unauthorized memory-dumping utilities.

bash

# Verify the installed UpSignOn version on a Windows endpoint
Get-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*" |
  Where-Object { $_.DisplayName -like "UpSignOn*" } |
  Select-Object DisplayName, DisplayVersion, Publisher