Cpe:2.3:a:araxis:merge:*:*:*:*:*:windows:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3aaraxismergewindows/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSun, 25 Oct 2026 03:40:33 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgAraxis Merge: Local credential decryption via DPAPI (CVE-2026-92680)https://feed.craftedsignal.io/briefs/2026-10-araxis-merge-dpapi-exposure/Sun, 25 Oct 2026 03:40:33 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-araxis-merge-dpapi-exposure/Araxis Merge for Windows stores server credentials using DPAPI with NULL entropy, allowing an attacker with local user access to decrypt and extract stored credentials from the registry.Araxis Merge for Windows versions 2011.4074 through 2026.0 contain a vulnerability (CVE-2026-92680) in how server credentials are stored. The application utilizes the Windows Data Protection API (DPAPI) with a NULL value for the optional entropy parameter, rendering the encryption ineffective against any process executing within the same user security context. This allows an authenticated local user to programmatically access and decrypt credentials stored in the registry path HKCU\Software\Araxis\Merge\7.1\Passwords.

Impact

Successful exploitation allows for the recovery of plaintext credentials used by Araxis Merge to connect to remote servers. This impact is limited to the local user context; an attacker must already have the ability to execute code as the target user.

Recommendation

  • Upgrade Araxis Merge for Windows to version 2026.1 or later to implement secure credential storage.
  • Review security logs for anomalous execution of scripts or tools attempting to query the specified registry key.
  • Audit user-level permissions to ensure that only authorized processes and users can access sensitive application registry hives.
]]>lowadvisorycredential-theftdpapiwindowslocal-exploitation