CVE-2026-92680— Araxis Merge insufficiently protected credentials
Quick assessment
Affected
Araxis Merge
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Araxis Merge for Windows 版本 2011.4074 至 2026.0 将用户配置的远程服务器凭据存储在 Windows 注册表中，但未提供足够的加密保护。经过身份验证的非管理员攻击者可以检索并解密目标用户在 Merge 中存储的所有凭据。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-92680
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Araxis Merge insufficiently protected credentials
Source: CVE Program / CVE List V5
Vulnerability Description
Araxis Merge for Windows version 2011.4074 through 2026.0 stores user-configured credentials for remote servers in the Windows registry and does not apply sufficient cryptographic protection. An authenticated, non-administrative attacker could retrieve and unencrypt all credentials the target user has stored in Merge.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
不充分的凭证保护机制
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-92680
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-92680
请登录查看更多情报信息。
News Coverage for CVE-2026-92680 (1)
-
🔗 CVE Record: CVE-2026-92680 vdb-entry
Other References for CVE-2026-92680 (3)
-
https://github.com/grepstrength/CVE-2026-92680 technical-description
-
https://grepstrength.com/research/araxis-merge third-party-advisory
IV. Related Vulnerabilities
Same weakness: CWE-522
-
CVE-2026-101089
Nezha before 2.2.7 Information Disclosure via /api/v1/profil -
CVE-2026-100569
OpenClaw before 2026.8.1 Credential Exposure via Endpoint Ov -
CVE-2026-81208
DataStage on Cloud Pak for Data has several vulnerabilities -
CVE-2026-18124
IBM Financial Transaction Manager (FTM) is Impacted by Multi -
CVE-2026-17643
IBM Financial Transaction Manager (FTM) is Impacted by Multi
V. Comments for CVE-2026-92680
No comments yet