CVE-2026-75136 Overview
CVE-2026-75136 is an insecure credential storage vulnerability [CWE-522] in UpSignOn for Windows before version 7.19.0. The password manager stores its biometric unlock key in the Windows PasswordVault API without protecting access behind an authentication prompt. Any local process running in the same Windows session can retrieve the key, decrypt the protected vault files, and export the entire password manager contents in cleartext. Exploitation requires local access with low privileges but no user interaction.
Critical Impact
A local attacker or malware running in a victim's Windows session can silently exfiltrate all credentials stored in the UpSignOn vault without triggering biometric or password prompts.
Affected Products
- UpSignOn for Windows versions prior to 7.19.0
Discovery Timeline
- 2026-09-02 - CVE-2026-75136 published to NVD
- 2026-09-02 - Last updated in NVD database
Technical Details for CVE-2026-75136
Vulnerability Analysis
UpSignOn for Windows uses the Windows PasswordVault API to persist the biometric unlock key that decrypts the local vault database. The PasswordVault API returns stored credentials to any process running as the same user in the same session, without prompting for authentication or biometric confirmation. Because UpSignOn does not layer additional protection over this key, the biometric protection boundary is enforced only by the UpSignOn UI, not by the operating system.
An attacker with code execution in the user's session can enumerate vault entries through the PasswordVault API, retrieve the biometric key, and use it to decrypt the on-disk vault. All stored logins, notes, and secrets are then exposed in cleartext.
Root Cause
The root cause is a design flaw in credential storage. Sensitive key material is stored in a location whose access controls do not match the sensitivity of the data. PasswordVault provides per-user separation but does not authenticate the requesting application, so any binary the user can execute inherits access to the stored key.
Attack Vector
Exploitation is local. An attacker must first execute code in the target user's Windows session, for example through a phishing payload, a malicious installer, or an already-compromised low-privilege account. From that context, the attacker calls the standard PasswordVault COM interface to enumerate and read the UpSignOn credential, then decrypts the vault files on disk. No elevation, kernel access, or UI interaction is required. See the VulnCheck Advisory on UpSignOn Key Exposure for technical details.
Detection Methods for CVE-2026-75136
Indicators of Compromise
- Unexpected processes loading Windows.Security.Credentials.dll or invoking the PasswordVault COM interface outside of the legitimate UpSignOn executable.
- Access to UpSignOn vault files on disk by processes other than the UpSignOn client.
- Outbound network transfers shortly after non-UpSignOn processes query the credential vault.
Detection Strategies
- Monitor endpoint telemetry for calls to Windows.Security.Credentials.PasswordVault from unsigned or non-UpSignOn binaries.
- Alert on unusual child processes spawned from browsers, Office applications, or scripting engines that subsequently read from the credential vault.
- Correlate credential-vault access events with file reads of UpSignOn's local database to identify decryption attempts.
Monitoring Recommendations
- Enable command-line and API call auditing on endpoints where UpSignOn is installed.
- Track UpSignOn client versions across the fleet and alert on installations below 7.19.0.
- Review authentication and DPAPI-related event logs for anomalous access patterns tied to password-manager processes.
How to Mitigate CVE-2026-75136
Immediate Actions Required
- Upgrade all UpSignOn for Windows installations to version 7.19.0 or later.
- Rotate credentials stored in any UpSignOn vault that resided on a potentially compromised endpoint.
- Audit endpoints for unauthorized software that could have queried the PasswordVault API prior to patching.
Patch Information
UpSignOn addressed the issue in version 7.19.0. Details are available in the UpSignOn Release Notes 7.19.0. Upgrading is the only supported remediation path.
Workarounds
- Disable the biometric unlock feature in UpSignOn until the client is upgraded, forcing master-password entry for every unlock.
- Restrict local execution on managed endpoints through application allowlisting to reduce the risk of untrusted processes calling PasswordVault.
- Enforce least-privilege on user accounts and limit shared-workstation scenarios where multiple users can access the same Windows session.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
