What’s Vulnerable › Vulnerabilities

CVE-2026-75136: UpSignOn < 7.19.0 Biometric Key Exposure via Windows PasswordVault

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-02 · updated 2026-09-08
• Weakness: CWE-522

Description

UpSignOn for Windows before 7.19.0 contains an insecure credential storage vulnerability that allows local attackers to retrieve the biometric unlock key stored in the Windows PasswordVault API without triggering any authentication prompt. Attackers can access the stored biometric key from a standard local process within the same Windows session to decrypt the protected vault files and export the entire password manager contents in cleartext.

Affected products

• Septeo IT Solutions UpSignOn: before 7.19.0 — fixed in 7.19.0

How to fix

Upgrade to a fixed version: Septeo IT Solutions UpSignOn 7.19.0. Check the vendor advisory for mitigations.

References

• https://upsignon.eu/en/resources/release-notes/app#7.19.0
• https://www.vulncheck.com/advisories/upsignon-biometric-key-exposure-via-windows-passwordvault

Get alerted when CVE-2026-75136 or the next vulnerability affects your stack