Araxis Merge for Windows version 2011.4074 through 2026.0 stores user-configured credentials for remote servers in the Windows registry and does not apply sufficient cryptographic protection.
CVSS 4.0MEDIUM 6.8·Local·Low privileges·No interaction·EPSS 0.00165·Published 2026-09-24·Fixed in 2026.1CWE-522