Medium severity5.5NVD Advisory· Published Sep 24, 2026

CVE-2026-92680

Description

Araxis Merge for Windows version 2011.4074 through 2026.0 stores user-configured credentials for remote servers in the Windows registry and does not apply sufficient cryptographic protection. An authenticated, non-administrative attacker could retrieve and unencrypt all credentials the target user has stored in Merge.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Araxis/Mergellm-create
Range: 2011.4074 - 2026.0
Grepstrength/CVE 2026 92680references

Patches

Vulnerability mechanics

References

grepstrength.com/research/araxis-mergenvd
raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-267-01.jsonnvd
www.araxis.com/merge/release-notes-2026nvd
www.cve.org/CVERecordnvd

News mentions

No linked articles in our index yet.

cvss	0.358
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000