Araxis Merge for Windows stores remote server credentials in the Windows registry without adequate cryptographic protection. An attacker who is already authenticated as a non‑administrative user can read this registry data and recover all stored credentials in plain text, enabling compromise of the remote services the user accesses.

The vulnerability affects Araxis Merge for Windows versions 2011.4074 through 2026.0. All users of these releases who have configured remote server credentials in the application are at risk.

The CVSS score of 6.8 indicates a moderate severity. The EPSS score is not available and the vulnerability is not listed in CISA KEV, suggesting limited widespread exposure at this time. Relying on an authenticated non‑administrative local attacker, exploitation requires that the attacker can run on the target machine with a user account that has access to Merge’s registry entries. The attack vector is thereby inferred to be local. Given the moderate score and lack of public exploitation data, the risk is present but not imminently critical.