Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-75137— UpSignOn < 7.19.0 Sensitive Data Exposure in Process Memory after Lock

Quick assessment

Affected

Septeo IT Solutions UpSignOn

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Septeo UpSignOn是法国Septeo公司的一款提供数字签名功能的电子签名服务平台。 Septeo UpSignOn 7.19.0之前版本存在加密问题漏洞，该漏洞源于进程内存中明文存储敏感数据，可能导致本地攻击者利用PROCESS_VM_READ权限读取UpSignOn.exe内存空间，提取条目名称、URL、用户名、密码、TOTP机密和备注等敏感信息。

CVSS 6.1 · Medium EPSS 0.10% · P1 Updated Sep 03, 2026

Possible ATT&CK Techniques 1 AI

T1059 · Command and Scripting Interpreter

Affected Version Matrix 1

Vendor	Product	Version Range	Status
Septeo IT Solutions	UpSignOn	`< 7.19.0`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-75137

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

UpSignOn < 7.19.0 Sensitive Data Exposure in Process Memory after Lock

Source: CVE Program / CVE List V5

Vulnerability Description

UpSignOn for Windows before 7.19.0 contains a sensitive data exposure vulnerability that allows local attackers to recover cleartext vault data from process memory even after the application has been locked. Attackers can use the PROCESS_VM_READ permission to read the memory space of UpSignOn.exe and extract sensitive fields including entry names, URLs, usernames, passwords, TOTP secrets, and notes.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

在内存中的明文存储

Source: CVE Program / CVE List V5

Vulnerability Title

Septeo UpSignOn 加密问题漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Septeo IT Solutions	UpSignOn	0 ~ 7.19.0	-

II. Public POCs for CVE-2026-75137

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-75137

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-75137 (1)

🔗 UpSignOn < 7.19.0 Sensitive Data Exposure in Process Memory after Lock | Advisories | VulnCheck third-party-advisory

Vendor Pages for CVE-2026-75137 (1)

🔗 Release notes Read full article release-notes

https://www.cve.org/CVERecord?id=CVE-2026-75137

Same Patch Batch · Septeo IT Solutions · 2026-09-02 · 3 CVEs total

CVE-2026-75135	6.1 MEDIUM	UpSignOn < 7.19.0 Sensitive Key Retention in Memory
CVE-2026-75136	6.1 MEDIUM	UpSignOn < 7.19.0 Biometric Key Exposure via Windows PasswordVault

IV. Related Vulnerabilities

Same product: UpSignOn

Same vendor: Septeo IT Solutions

Same weakness: CWE-316