What is CVE-2026-75137?

CVE-2026-75137 is a medium-severity vulnerability, classified under CWE-316. CVSS score: 6.1/10. Published 2026-09-02.

How severe is CVE-2026-75137?

Medium severity. CVSS v3 base score is 6.1 out of 10.

CVE-2026-75137

CVE-2026-75137

UpSignOn for Windows before 7.19.0 contains a sensitive data exposure vulnerability that allows local attackers to recover cleartext vault data from process memory even after the application has been locked. Attackers can use the PROCESS_VM_READ permission to read the memory space of UpSignOn.exe and extract sensitive fields including entry names, URLs, usernames, passwords, TOTP secrets, and notes.

CVSS v3 metric

CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N.

Weakness classification (CWE)

CWE-316

References

disclosure@vulncheck.com
disclosure@vulncheck.com

Frequently asked questions

What is CVE-2026-75137?: CVE-2026-75137 is a medium-severity vulnerability, classified under CWE-316. CVSS score: 6.1/10. Published 2026-09-02.
How severe is CVE-2026-75137?: Medium severity. CVSS v3 base score is 6.1 out of 10.