{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3aaraxismergewindows/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:araxis:merge:*:*:*:*:*:windows:*:*"],"_cs_cves":[{"cvss":5.5,"id":"CVE-2026-92680"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Araxis Merge for Windows (2011.4074 - 2026.0)"],"_cs_severities":["low"],"_cs_tags":["credential-theft","dpapi","windows","local-exploitation"],"_cs_type":"advisory","_cs_vendors":["Araxis Ltd."],"content_html":"\u003cp\u003eAraxis Merge for Windows versions 2011.4074 through 2026.0 contain a vulnerability (CVE-2026-92680) in how server credentials are stored. The application utilizes the Windows Data Protection API (DPAPI) with a NULL value for the optional entropy parameter, rendering the encryption ineffective against any process executing within the same user security context. This allows an authenticated local user to programmatically access and decrypt credentials stored in the registry path \u003ccode\u003eHKCU\\Software\\Araxis\\Merge\\7.1\\Passwords\u003c/code\u003e.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for the recovery of plaintext credentials used by Araxis Merge to connect to remote servers. This impact is limited to the local user context; an attacker must already have the ability to execute code as the target user.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Araxis Merge for Windows to version 2026.1 or later to implement secure credential storage.\u003c/li\u003e\n\u003cli\u003eReview security logs for anomalous execution of scripts or tools attempting to query the specified registry key.\u003c/li\u003e\n\u003cli\u003eAudit user-level permissions to ensure that only authorized processes and users can access sensitive application registry hives.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-25T03:40:33Z","date_published":"2026-10-25T03:40:33Z","id":"https://feed.craftedsignal.io/briefs/2026-10-araxis-merge-dpapi-exposure/","summary":"Araxis Merge for Windows stores server credentials using DPAPI with NULL entropy, allowing an attacker with local user access to decrypt and extract stored credentials from the registry.","title":"Araxis Merge: Local credential decryption via DPAPI (CVE-2026-92680)","url":"https://feed.craftedsignal.io/briefs/2026-10-araxis-merge-dpapi-exposure/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:araxis:merge:*:*:*:*:*:windows:*:*","version":"https://jsonfeed.org/version/1.1"}