CVE-2026-92680

Araxis Merge for Windows version 2011.4074 through 2026.0 stores user-configured credentials for remote servers in the Windows registry and does not apply sufficient cryptographic protection. An authenticated, non-administrative attacker could retrieve and unencrypt all credentials the target use...

CVE-2026-92680

CVE-2026-92680 Araxis Merge for Windows stores server credentials with DPAPI with pOptionalEntropy set to NULL. This allows any code running in the same user context to decrypt them. Full writeup: https://grepstrength.com/research/araxis-merge | ---|--- CVE| CVE-2026-92680 CWE| CWE-522:...

EUVD-2026-85933

Araxis Merge for Windows version 2011.4074 through 2026.0 stores user-configured credentials for remote servers in the Windows registry and does not apply sufficient cryptographic protection. An authenticated, non-administrative attacker could retrieve and unencrypt all credentials the target use...

CVE-2026-92680

Araxis Merge for Windows versions 2011.4074 through 2026.0 are vulnerable to insufficient protection of user-configured credentials for remote servers. The software stores these credentials in the Windows registry without applying adequate cryptographic protection. An authenticated, non-administr...