CVE-2026-92680

Description

Araxis Merge for Windows version 2011.4074 through 2026.0 stores user-configured credentials for remote servers in the Windows registry and does not apply sufficient cryptographic protection. An authenticated, non-administrative attacker could retrieve and unencrypt all credentials the target user has stored in Merge.

Overview

State: PUBLISHED
Assigner (CNA): cisa-cg
CVSS severity: MEDIUM
CVSS score: 6.8 / 10
CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Effective score: 6.8 / 10 MEDIUM source: CNA overview
CWE(s): CWE-522
Reserved: 2026-09-16
Published: 2026-09-24 15:01 UTC
Last updated: 2026-09-24 15:01 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/92xxx/CVE-2026-92680.json

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2026-85933
Assigner: cisa-cg
Published: Sep 24, 2026, 3:01:10 PM
Updated: Sep 24, 2026, 3:01:10 PM
EUVD base score (CVSS 4.0): 6.8 / 10
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EUVD-reported EPSS: 0.0000
Vendors: Araxis
Products: merge (2011.4074 <2026.1)
Aliases: GHSA-hfv3-23j2-3cp6

ENISA description: Araxis Merge for Windows version 2011.4074 through 2026.0 stores user-configured credentials for remote servers in the Windows registry and does not apply sufficient cryptographic protection. An authenticated, non-administrative attacker could retrieve and unencrypt all credentials the target user has stored in Merge.

EUVD references (5)

Affected products (1)

Vendor	Product	Versions	Platforms
Araxis	Merge	`2011.4074` (affected), `2026.1` (unaffected)	—

Vendor references (5)

References embedded in the original CVE record by the assigning CNA.

url vendor-advisory
url third-party-advisory
url vdb-entry
url third-party-advisory
url technical-description

Web references (0)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

No web references attached yet.

Remediations (10)

CVE-2026-92680 - Araxis Merge insufficiently protected credentials

web:cvefeed.io

Araxis Merge for Windows version 2011.4074 through 2026.0 stores user-configured credentials for remote servers in the Windows registry and does not apply sufficient cryptographic protection. An authenticated, non-administrative attacker could retrieve and unencrypt all credentials the target user has stored in Merge.

2026-09-25 10:45 UTC
CVE-2026-92680: Araxis Merge Vulnerability (CVSS 5.5) | CVETodo

web:cvetodo.com

CVE-2026-92680 is a CVSS 5.5 medium-severity vulnerability in Araxis Merge. Full technical analysis, mitigations , and exploit status — updated in real time.

2026-09-25 10:45 UTC
Windows 11, version 23H2 known issues and notifications

web:learn.microsoft.com

As of November 11, 2025, Home and Pro editions of Windows 11, version 23H2 have reached end of servicing. Enterprise and Education editions of version 23H2 will continue to receive monthly security updates until November 10, 2026 .

2026-09-25 10:45 UTC
Security Update Guide - Microsoft

web:msrc.microsoft.com

The Microsoft Security Response Center (MSRC) investigates all reports of security vulnerabilities affecting Microsoft products and services, and provides the information here as part of the ongoing effort to help you manage security risks and help keep your systems protected.

2026-09-25 10:45 UTC
Microsoft Patch Tracker (September 2026): Exploit-Ranked | Senserva

web:senserva.com

Every Microsoft security patch (KB) and the CVEs it fixes, with severity, CVSS, and CISA KEV status. Cross-linked to the CVE reference.

2026-09-25 10:45 UTC
July 18, 2026—Hotpatch KB5121768 (OS Builds 26200.8893 and 26100.8893 ...

web:support.microsoft.com

This out-of-band (OOB) update for Windows 11, version 25H2 and Windows 11, version 24H2 (KB5121768) is cumulative. It includes all improvements from previous security and non-security updates, along with an additional fix . Improvements This OOB update includes the following improvement: [System Performance] This update addresses an issue affecting a limited number of devices with an Intel ...

2026-09-25 10:45 UTC
CVE-2026-92680 - Araxis Merge for Windows Credential…

web:vulmon.com

Vulnerability Summary User-configured credentials for remote servers stored in Araxis Merge for Windows versions 2011.4074 through 2026.0 lack adequate cryptographic protection. An authenticated, non-administrative attacker may retrieve and unencrypt all credentials stored by the target user in Merge. Subscribe to Araxis

2026-09-25 10:45 UTC
CVE-2026-92680 - vulnerability database | Vulners.com

web:vulners.com

CVE-2026-92680 🗓️ 24 Sep 2026 08:01:10 Reported by cisa-cg Type cve 🔗 web.nvd.nist.gov 📰️ 1 Media mentions 👁 6 Views

2026-09-25 10:45 UTC
CVE-2026-92680: Araxis Merge: Araxis Merge for Windows version ... - Rapid7

web:www.rapid7.com

CVE-2026-92680 : Araxis Merge: Araxis Merge for Windows version 2011.4074 through 2026.0 stores user-configured credentials for remote servers in the…. View severity, references, and remediation details from Rapid7.

2026-09-25 10:45 UTC
CVE-2026-92680 | Tenable®

web:www.tenable.com

Araxis Merge for Windows version 2011.4074 through 2026.0 stores user-configured credentials for remote servers in the Windows registry and does not apply sufficient cryptographic protection. An authenticated, non-administrative attacker could retrieve and unencrypt all credentials the target user has stored in Merge.

2026-09-25 10:45 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-92680.json.

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Merge",
          "vendor": "Araxis",
          "versions": [
            {
              "lessThan": "2026.1",
              "status": "affected",
              "version": "2011.4074",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "2026.1"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Kelvin Winborne (grepStrength), grepStrength Security LLC"
        }
      ],
      "datePublic": "2026-09-23T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Araxis Merge for Windows version 2011.4074 through 2026.0 stores user-configured credentials for remote servers in the Windows registry and does not apply sufficient cryptographic protection. An authenticated, non-administrative attacker could retrieve and unencrypt all credentials the target user has stored in Merge."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        },
        {
          "other": {
            "content": {
              "id": "CVE-2026-92680",
              "options": [
                {
                  "Exploitation": "none"
                },
                {
                  "Automatable": "no"
                },
                {
                  "Technical Impact": "partial"
                }
              ],
              "role": "CISA Coordinator",
              "timestamp": "2026-09-16T17:36:45.331736Z",
              "version": "2.0.3"
            },
            "type": "ssvc"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-522",
              "description": "CWE-522 Insufficiently Protected Credentials",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-24T15:01:10.919Z",
        "orgId": "9119a7d8-5eab-497f-8521-727c672e3725",
        "shortName": "cisa-cg"
      },
      "references": [
        {
          "name": "url",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.araxis.com/merge/release-notes-2026#Merge-SA-26-00"
        },
        {
          "name": "url",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://grepstrength.com/research/araxis-merge"
        },
        {
          "name": "url",
          "tags": [
            "vdb-entry"
          ],
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-92680"
        },
        {
          "name": "url",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-267-01.json"
        },
        {
          "name": "url",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/grepstrength/CVE-2026-92680"
        }
      ],
      "title": "Araxis Merge insufficiently protected credentials"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9119a7d8-5eab-497f-8521-727c672e3725",
    "assignerShortName": "cisa-cg",
    "cveId": "CVE-2026-92680",
    "datePublished": "2026-09-24T15:01:10.919Z",
    "dateReserved": "2026-09-16T16:12:44.503Z",
    "dateUpdated": "2026-09-24T15:01:10.919Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}