CVE-2026-92680
Medium
Description
Araxis Merge for Windows version 2011.4074 through 2026.0 stores user-configured credentials for remote servers in the Windows registry and does not apply sufficient cryptographic protection. An authenticated, non-administrative attacker could retrieve and unencrypt all credentials the target user has stored in Merge.
SeverityMedium
CVSS5.5
Exploit probability—
Product
Merge
PublishedSep 24, 2026
First seenSep 24, 2026
Weakness typeCWE-522CWE-522
How to fix
Update
- Araxis Merge2026.1 or later
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Araxis Merge | 2011.4074 ≤ v < 2026.1 | 2026.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.