Skip to content
Threat Feed
Subscribe
low advisory

Araxis Merge: Local credential decryption via DPAPI (CVE-2026-92680)

Araxis Merge for Windows stores server credentials using DPAPI with NULL entropy, allowing an attacker with local user access to decrypt and extract stored credentials from the registry.

CVE search metadata

CVE search record: CVE-2026-92680. Severity: medium. CVSS: 5.5. EPSS: 0.17%. KEV: no. Product: Araxis Merge for Windows (2011.4074 - 2026.0). Brief: Araxis Merge: Local credential decryption via DPAPI (CVE-2026-92680). Brief link: https://feed.craftedsignal.io/briefs/2026-10-araxis-merge-dpapi-exposure/

Triage facts

Revision 1
Applicability
Araxis Merge for Windows (2011.4074 - 2026.0)
Evidence
Unknown
Severity
Low
Action
Elevated
Sources
3 public sources
Freshness
Revision 1Oct 25, 03:40 UTC
Detection
1 rule
Vulnerabilities
1 CVE
Source quality
B2Likely

Araxis Merge for Windows versions 2011.4074 through 2026.0 contain a vulnerability (CVE-2026-92680) in how server credentials are stored. The application utilizes the Windows Data Protection API (DPAPI) with a NULL value for the optional entropy parameter, rendering the encryption ineffective against any process executing within the same user security context. This allows an authenticated local user to programmatically access and decrypt credentials stored in the registry path HKCU\Software\Araxis\Merge\7.1\Passwords.

Impact

Successful exploitation allows for the recovery of plaintext credentials used by Araxis Merge to connect to remote servers. This impact is limited to the local user context; an attacker must already have the ability to execute code as the target user.

Recommendation

  • Upgrade Araxis Merge for Windows to version 2026.1 or later to implement secure credential storage.
  • Review security logs for anomalous execution of scripts or tools attempting to query the specified registry key.
  • Audit user-level permissions to ensure that only authorized processes and users can access sensitive application registry hives.

Immediate actions

Patch Araxis Merge to version 2026.1

IT Operations 7d

Threat Hunt

Identify processes reading the Araxis registry hive using EDR registry monitoring

T1552.001 high high confidence convert to detection

Data: Registry read events

Mitigations

Upgrade to version 2026.1

immediate IT Operations

CVE-2026-92680

Detection coverage 1

Detect Access to Araxis Merge Registry Credentials

medium

Detects processes querying the registry key containing Araxis Merge passwords, which may indicate attempted credential extraction

sigma tactics: credential_access techniques: T1552.001 sources: registry_set, windows

Detection queries are available on the platform. Get full rules →