CVE-2026-75137: UpSignOn Windows Information Disclosure Flaw

CVE-2026-75137 Overview

CVE-2026-75137 is a sensitive data exposure vulnerability in UpSignOn for Windows versions before 7.19.0. The application retains decrypted vault contents in process memory after the user locks the vault. A local attacker with sufficient privileges can open a handle to UpSignOn.exe using PROCESS_VM_READ and scrape cleartext credentials from the process address space. Extractable data includes entry names, URLs, usernames, passwords, Time-based One-Time Password (TOTP) secrets, and notes. The weakness is classified under [CWE-316: Cleartext Storage of Sensitive Information in Memory].

Critical Impact
Local attackers can recover cleartext vault secrets from a locked UpSignOn client, defeating the security guarantee provided by the lock feature.

Affected Products

UpSignOn for Windows versions prior to 7.19.0
UpSignOn desktop password manager client
Fixed in UpSignOn 7.19.0

Discovery Timeline

2026-09-02 - CVE-2026-75137 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-75137

Vulnerability Analysis

UpSignOn is a password manager that stores credentials in an encrypted vault. When the user unlocks the vault, the client decrypts entries and holds them in memory for use. In versions before 7.19.0, the application fails to wipe or re-encrypt these decrypted structures when the user locks the vault. The plaintext values remain resident in the UpSignOn.exe heap until the process exits.

Any local process running under the same user context, or with SeDebugPrivilege, can obtain a handle to the running client and read its virtual memory. The attacker does not need to inject code, hook APIs, or bypass the master password. Credentials, TOTP seeds, and note fields can be extracted verbatim from the running process.

Root Cause

The root cause is improper lifecycle management of sensitive data in memory. The lock operation clears the user interface but does not clear the underlying decrypted vault structures. Because Windows heap allocations for strings and objects persist until freed and overwritten, secrets remain recoverable by memory-scanning tooling.

Attack Vector

Exploitation requires local access with low privileges. An attacker calls OpenProcess against UpSignOn.exe with the PROCESS_VM_READ access right, then uses ReadProcessMemory to enumerate committed regions and search for known vault field markers. The attack works after the vault has been locked, so it is effective against unattended workstations where the user believes locking the vault has revoked access to secrets. See the VulnCheck Advisory for further technical detail.

Detection Methods for CVE-2026-75137

Indicators of Compromise

Processes other than UpSignOn opening handles to UpSignOn.exe with PROCESS_VM_READ access rights.
Unexpected use of ReadProcessMemory against the UpSignOn process by non-debugger tooling.
Presence of memory-dumping utilities such as procdump.exe, MiniDumpWriteDump callers, or third-party memory scrapers on user endpoints.
Creation of .dmp files targeting the UpSignOn process ID in temp or user profile directories.

Detection Strategies

Monitor endpoint telemetry for cross-process memory reads targeting known password-manager processes.
Alert on invocation of MiniDumpWriteDump or NtReadVirtualMemory against UpSignOn.exe from non-Microsoft signed binaries.
Baseline the set of processes that legitimately interact with the UpSignOn client and flag deviations.

Monitoring Recommendations

Track installed versions of UpSignOn across the fleet and flag hosts below 7.19.0.
Log Sysmon Event ID 10 (ProcessAccess) events where the target image is UpSignOn.exe.
Review scheduled tasks, services, and startup entries for unfamiliar tools that could perform memory scraping.

How to Mitigate CVE-2026-75137

Immediate Actions Required

Upgrade all UpSignOn Windows clients to version 7.19.0 or later.
Fully exit the UpSignOn client (not just lock) on shared or unattended workstations until the patch is applied.
Restrict local administrative rights and audit accounts that hold SeDebugPrivilege.
Rotate high-value credentials stored in UpSignOn if unpatched clients ran on multi-user or potentially compromised hosts.

Patch Information

UpSignOn addressed the issue in version 7.19.0. Refer to the UpSignOn Release Notes 7.19.0 for the official fix advisory and update instructions.

Workarounds

Close the UpSignOn process entirely when the vault is not in active use, rather than relying on the lock function.
Enforce least privilege on endpoints to prevent unauthorized processes from acquiring PROCESS_VM_READ handles.
Enable Windows Defender Credential Guard and application control policies to limit execution of unsigned memory-inspection tools.

bash

# Configuration example
# PowerShell: identify hosts running UpSignOn versions below 7.19.0
Get-CimInstance Win32_Product | Where-Object { $_.Name -like 'UpSignOn*' -and [version]$_.Version -lt [version]'7.19.0' }