CVE-2026-92680

5.5 MEDIUMpublic exploit available

Published 2026-09-24 · Updated 2026-09-26

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

Araxis Merge for Windows version 2011.4074 through 2026.0 stores user-configured credentials for remote servers in the Windows registry and does not apply sufficient cryptographic protection. An authenticated, non-administrative attacker could retrieve and unencrypt all credentials the target user has stored in Merge.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weaknesses

CWE-522

Public exploit & PoC references

https://github.com/grepstrength/CVE-2026-92680

All references

https://github.com/grepstrength/CVE-2026-92680
https://grepstrength.com/research/araxis-merge
https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-267-01.json
https://www.araxis.com/merge/release-notes-2026#Merge-SA-26-00
https://www.cve.org/CVERecord?id=CVE-2026-92680

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

HIGHCVE-2026-100298
MEDIUMCVE-2026-100569PoC
LOWCVE-2026-101089PoC
HIGHCVE-2026-17643
MEDIUMCVE-2026-18124
CRITICALCVE-2026-20234
HIGHCVE-2026-48976PoC
LOWCVE-2026-49449PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.