CVE-2026-92680 describes a vulnerability in Araxis Merge for Windows where user credentials for remote servers are stored insecurely in the Windows registry. The credentials lack adequate cryptographic protection, enabling an authenticated user with limited privileges to extract and decrypt these credentials. This vulnerability affects versions >=2011.4074 and <2026.1 of Araxis Merge. There are no known exploits in the wild, and the vulnerability does not require administrative privileges but does require authentication.

An authenticated, non-administrative attacker can access and decrypt all remote server credentials stored by the affected versions of Araxis Merge. This could lead to unauthorized access to remote servers using the compromised credentials. The vulnerability does not allow privilege escalation or remote unauthenticated exploitation but compromises confidentiality of stored credentials.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, limit access to affected systems to trusted users only and consider alternative secure credential storage methods if possible.