EUVD-2026-85933
GHSA-hfv3-23j2-3cp6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain authenticated local access to Windows host
-
DeliveryRead Merge credential values from registry
-
ExploitReverse weak/reversible encryption
-
ExecutionRecover plaintext remote-server credentials
-
ImpactReuse creds to access remote servers
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V6 - Authentication Credential protection in transit/storage
|
| Exploitation Conditions | Requires an authenticated, non-administrative local user account on the same Windows host running Araxis Merge (versions 2011.4074 through 2026.0), and the target user must have configured/stored remote-server credentials within Merge. Exploitation limits: attack vector is local (no network exploitation), and the value of the flaw depends on the attacker being able to read the target user's Merge registry entries and on that user having saved credentials; there is no integrity or availability impact - the payoff is disclosure of stored remote-server credentials via reversal of the weak protection. |
| Impact | This is a moderate, locally-scoped credential-disclosure issue rather than a top-priority remotely-exploitable flaw. The vendor/CISA-CG CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H) confirms local access and low privileges are required, with high confidentiality impact but no integrity or availability impact - consistent with CWE-522 (insufficiently protected credentials). No EPSS score, no CISA KEV listing, and no SSVC decision data were supplied, so automatable/exploitation-status signals are absent from the input. However, the researcher (grepstrength) maintains a dedicated repository (github.com/grepstrength/CVE-2026-92680) plus a research write-up, which strongly implies publicly available exploit/PoC code exists. Net: low widespread-exploitation likelihood (local vector, niche product) but elevated concern where an attacker already has a foothold, because recovered credentials are for remote servers and enable lateral movement beyond the compromised host. There is no signal conflict between the CVSS vector and the description - both point to authenticated local access. |
| Exploit ScenarioDerived | On a shared or previously-compromised Windows workstation, a low-privileged authenticated user reads the Araxis Merge credential values from the Windows registry and reverses the weak/insufficient cryptographic protection to recover the target user's stored remote-server (e.g., FTP/SFTP/network) credentials in plaintext. Those recovered credentials are then reused to access remote servers, extending the compromise beyond the local machine. A researcher repository (grepstrength/CVE-2026-92680) appears to provide exploit/PoC code demonstrating the decryption. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 24, 2026
Weakly protected storage of remote-server credentials in Araxis Merge for Windows (versions 2011.4074 through 2026.0) allows an authenticated, non-administrative local user on the same host to recover and decrypt every credential the target user has saved in the product, because the credentials are kept in the Windows registry without sufficient cryptographic protection (CWE-522). The exposure is local-only (CVSS 4.0 6.8, AV:L/PR:L, confidentiality-only with no integrity or availability impact), so it is a moderate, locally-scoped credential-disclosure issue rather than a remotely exploitable flaw, and its real-world value depends on the attacker already holding an interactive account and on the victim having stored credentials. The issue is not listed in CISA KEV (no confirmed active exploitation); publicly available exploit code exists, and a researcher write-up plus a GitHub repository published under the grepstrength handle accompany the vendor advisory referenced in the CVE record.
RemediationAI
Apply the fix documented in the Araxis advisory for the 2026 release (Merge-SA-26-00, linked from the release notes at https://www.araxis.com/merge/release-notes-2026#Merge-SA-26-00); the exact patched version number is not confirmed in the available data, so verify the release notes before deploying and treat the 2026.0 boundary in the affected range as the reference point. Batch patch available per vendor advisory. Until the upgrade is applied, assume every remote-server credential previously saved in Merge on that host is compromised and rotate those passwords and keys at the remote endpoints - the trade-off is that rotation breaks any scripted or SSH-based workflows still using the old secrets until they are re-provisioned. As compensating controls, stop saving credentials in Merge and enter them per session instead, delete the user's existing stored Merge credential entries from the registry after exporting nothing, and restrict interactive logon on hosts running Merge to trusted accounts, since the exploit requires a valid low-privilege local account (its side effect is reduced convenience for regular users who rely on saved credentials and could push them toward weaker ad-hoc storage). Where practical, move remote-server secrets to an OS-protected store such as Windows Credential Manager/DPAPI and use keys or tokens scoped to a single server; monitor for unexpected reads of the user's Merge registry hive as a detection signal, noting that this is a telemetry-based measure and not a hard prevention control.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-522 (Insufficiently Protected Credentials): Araxis Merge persists user-configured credentials for remote servers into the Windows registry using a protection scheme that is reversible rather than a properly enforced secret-protection mechanism, so any process or user able to read those registry values can unencrypt them. This differs from the expected Windows pattern of binding secrets to the user's login credentials through the Data Protection API (DPAPI) or of storing them in a credential vault; the description states the protection is insufficient, and the CPE cpe:2.3:a:araxis:merge:*:*:*:*:*:*:*:* with the stated range identifies Araxis Merge for Windows from 2011.4074 through 2026.0 as affected, while the CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N) confines the issue to a local attacker with a low-privilege account, no user interaction, and no cross-boundary impact. Because the vector carries PR:L, exploitation is explicitly authenticated: the attacker needs a valid non-administrative account on the same Windows host. Scope is unchanged, and only confidentiality is affected - no modification or denial of service - meaning the technique yields credential theft for pivot/reuse rather than code execution or tampering on the Merge host itself.
Know when Merge gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Local authenticated non-admin access (AV:L/PR:L), no user interaction, straightforward registry read and decryption (AC:L); only credential confidentiality is impacted (C:H, I/A:N).
Primary rating from Vendor (cisa-cg).
CVSS VectorVendor: cisa-cg
Lifecycle Timeline
2DescriptionCVE.org
Araxis Merge for Windows version 2011.4074 through 2026.0 stores user-configured credentials for remote servers in the Windows registry and does not apply sufficient cryptographic protection. An authenticated, non-administrative attacker could retrieve and unencrypt all credentials the target user has stored in Merge.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
merge is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution'). Rated
The merge.recursive function in the merge package <1.2.1 can be tricked into adding or modifying properties of the Objec
Prototype pollution in brikcss merge library versions 1.0 through 1.3.0 enables remote unauthenticated attackers to inje
Merge PACS 7.0 contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized actions
The Samsung and HTC onTouchEvent method implementation for Android on the T-Mobile myTouch 3G Slide, HTC Merge, Sprint E
Exploit-DB