CVE-2026-92680 Araxis Merge insufficiently protected credentials
An authenticated local attacker can retrieve and decrypt stored remote server credentials from the Windows registry due to insufficient cryptographic protection.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-92680?
CVE-2026-92680 is a medium-severity vulnerability in Araxis Merge, published on 24 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Araxis Merge for Windows version 2011.4074 through 2026.0 stores user-configured credentials for remote servers in the Windows registry and does not apply sufficient cryptographic protection. An authenticated, non-administrative attacker could retrieve and unencrypt all credentials the target user has stored in Merge.
Weakness: CWE-522
Which versions are affected by CVE-2026-92680?
How do I fix CVE-2026-92680?
No fix has been published for CVE-2026-92680 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-92680 being exploited?
There is no known exploitation of CVE-2026-92680 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-hfv3-23j2-3cp6.