Crypttech Vatos DLP: Plaintext credential storage (CVE-2026-86715)
Crypttech Vatos DLP versions 1.1.176 through 1.1.242 store passwords in plaintext, facilitating unauthorized access to domain credentials.
CVE search metadata
CVE search record: CVE-2026-86715. Severity: high. CVSS: 7.1. KEV: no. Product: Vatos DLP (1.1.176 - 1.1.242). Brief: Crypttech Vatos DLP: Plaintext credential storage (CVE-2026-86715). Brief link: https://feed.craftedsignal.io/briefs/2026-10-vatos-dlp-plaintext-password/
Triage facts
Revision 1- Applicability
- Vatos DLP (1.1.176 - 1.1.242)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Oct 31, 03:46 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
Crypttech Vatos DLP (versions 1.1.176 through 1.1.242) contains a vulnerability where application passwords are stored in plaintext. This exposure allows unauthorized actors with access to the file system or application data to recover and reuse domain credentials.
Impact
Exposure of stored domain credentials within the Vatos DLP environment may lead to unauthorized access to enterprise systems and escalation of privileges.
Recommendation
- Update Vatos DLP to version 1.1.243 or later to remediate the plaintext storage vulnerability.
- Audit access logs for the Vatos DLP application directory to identify potential unauthorized file access during the window of vulnerability.
- Review and rotate domain service accounts that may have been configured within the affected Vatos DLP versions.
Immediate actions
Upgrade Vatos DLP to version 1.1.243 or later
Threat Hunt
Identify unauthorized access to Vatos DLP configuration or log files
Data: File access monitoring logs for Vatos DLP application directories
Mitigations
Rotate domain service account passwords used by Vatos DLP
CVE-2026-86715