CVE-2026-92680 in Merge
Summary
by MITRE • 09/24/2026
Araxis Merge for Windows version 2011.4074 through 2026.0 stores user-configured credentials for remote servers in the Windows registry and does not apply sufficient cryptographic protection. An authenticated, non-administrative attacker could retrieve and unencrypt all credentials the target user has stored in Merge.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/24/2026
The vulnerability identified involves a critical flaw in how Araxis Merge for Windows handles credential storage within its configuration system. Specifically, versions ranging from 2011.4074 through 2026.0 store user-configured credentials for remote servers directly in the Windows registry without applying sufficient cryptographic protection mechanisms. This architectural decision results in sensitive authentication data being persisted in a location that is accessible to any process running under the context of the logged-in user, thereby undermining the confidentiality guarantees expected from secure credential management practices.
From a technical perspective, the core issue lies in the lack of encryption or obfuscation for stored secrets within the registry keys associated with Araxis Merge. While Windows provides mechanisms such as Data Protection API (DPAPI) to encrypt data based on user context, this implementation fails to leverage these protections effectively. Consequently, any authenticated non-administrative attacker operating under the same user session can access the raw registry entries and retrieve plaintext credentials or easily reversible encoded strings for all remote servers configured within the application. This represents a fundamental failure in secure storage principles where sensitive data is treated with insufficient rigor regarding confidentiality at rest.
The operational impact of this vulnerability is significant, particularly in enterprise environments where developers or system administrators use Araxis Merge to interact with multiple remote repositories and servers. An attacker who gains access to the user's workstation, whether through malware execution, session hijacking, or physical access during an unlocked session, can extract these credentials without needing elevated privileges. The extracted credentials may include usernames, passwords, SSH keys, or other authentication tokens that grant access to version control systems like GitLab, GitHub, Bitbucket, or internal file servers. This exposure facilitates lateral movement within a network if the same credentials are reused across multiple services, potentially leading to unauthorized code commits, data exfiltration, or further compromise of dependent infrastructure.
This flaw aligns with CWE-798: Use of Hard-coded Credentials and more specifically CWE-321: Use of Hard-coded Encryption Key when considering improper handling of cryptographic keys, but most accurately maps to CWE-522: Insufficiently Protected Credentials due to the failure to encrypt sensitive data before storage. In terms of adversary tactics, this vulnerability supports techniques categorized under ATT&CK T1078: Valid Accounts and potentially T1552.004: Unsecured Credentials in Registry, as it allows an attacker to harvest valid authentication material from a local system configuration store without triggering typical privilege escalation alerts associated with administrative access requirements.
Mitigation strategies should focus on immediate remediation of the software version alongside broader credential hygiene practices. Users must upgrade Araxis Merge to a patched version that implements proper cryptographic storage mechanisms, such as leveraging Windows DPAPI or integrating with a dedicated secrets management solution like HashiCorp Vault or Azure Key Vault for storing remote server credentials. In the interim, organizations should enforce strict endpoint security policies to prevent unauthorized execution of code under user sessions and monitor registry access patterns for anomalies indicative of credential harvesting. Additionally, administrators should audit existing deployments for this vulnerability version range and ensure that any compromised credentials identified through forensic analysis are rotated immediately across all affected services to mitigate potential exploitation by malicious actors who may have already harvested these values from the wild or internal threat intelligence feeds.