Loading story…
Sonatype disclosed two high-severity vulnerabilities in Nexus Repository Manager 3 that can lead to arbitrary code execution. CVE-2026-3199 affects versions 3.22.1 through 3.90.2 and allows an authenticated user with task creation privileges to execute code through task property injection in the task management component. The flaw bypasses the nexus.scripts.allowCreation security control, indicating a failure in script-related policy enforcement, and has been mapped to CWE-502.
A second issue, CVE-2026-5189, affects versions 3.0.0 through 3.70.5 and stems from hard-coded credentials in an internal database component. If the non-default setting nexus.orient.binaryListenerEnabled=true is enabled, an unauthenticated network attacker can gain read and write access to the internal database and execute operating system commands as the Nexus process user. Sonatype linked the fixes to Nexus Repository 3.91.0 for CVE-2026-3199 and 3.71.0 for CVE-2026-5189, with both issues carrying high impact across confidentiality, integrity, and availability.
See real exploitation activity before you spend the cycle.
4 events from the most recent confirmed update back to the earliest known activity.
A CVE entry was published for the Nexus Repository hard-coded credential issue and mapped it to CWE-798. The disclosure described unauthenticated exploitation conditions, affected versions, and high impact to confidentiality, integrity, and availability.
Sonatype addressed a hard-coded credentials vulnerability affecting Nexus Repository Manager versions 3.0.0 through 3.70.5 in release 3.71.0. When the non-default setting nexus.orient.binaryListenerEnabled=true was enabled, the flaw could allow unauthenticated network attackers to access the internal database and execute OS commands as the Nexus process user.
A CVE entry was published for the Nexus Repository task property injection vulnerability and mapped it to CWE-502. The disclosure stated that authenticated attackers with task creation permissions could achieve remote code execution with high impact across confidentiality, integrity, and availability.
Sonatype addressed an authenticated remote code execution flaw in the task management component of Nexus Repository in version 3.91.0. The issue affected versions 3.22.1 through 3.90.2 and allowed attackers with task creation permissions to execute arbitrary code by bypassing the nexus.scripts.allowCreation security control.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
dCERT issued advisories for two vulnerabilities affecting **Sonatype Nexus Repository Manager**, warning that one flaw allows **cross-site scripting (XSS)** and another can **bypass security measures** and may lead to **potential code execution**. The issues affect a widely used artifact repository platform that often sits in software build and package distribution workflows. The paired advisories indicate risk ranging from browser-based compromise through XSS to more serious server-side impact if security controls can be circumvented. Organizations using Sonatype Nexus Repository Manager should review the relevant dCERT advisories, identify affected deployments, and prioritize vendor guidance and remediation to reduce exposure in development and supply-chain infrastructure.
Jun 29, 2026
Sonatype disclosed **CVE-2026-10748**, a high-severity remote code execution flaw in **Nexus Repository 3** affecting versions before **3.92.0**. The vulnerability stems from unsafe deserialization in license handling and allows an authenticated user with the `nx-licensing-create` privilege to upload a crafted license file and execute arbitrary operating system commands as the Nexus process user. The issue carries a **CVSS 4.0 score of 8.6**. Organizations running Nexus Repository 3 are being urged to upgrade to **3.92.0 or later**, apply vendor patches, and tightly restrict assignment of the `nx-licensing-create` privilege to reduce exposure. A separate F5 advisory also noted **CVE-2026-42530** affecting the **NGINX `ngx_http_v3_module`**, but no technical synopsis was provided in the available reference.
Jun 29, 2026
Sonatype Nexus Repository 3 Community Edition and Pro contain a high-severity authorization flaw tracked as **CVE-2026-17594** that lets a user with delegated repository-admin rights for one repository format create a repository in a different, unauthorized format. The issue affects versions `3.0.0` through `3.94.x` and stems from the repository-creation workflow validating permissions against one request field while using a separate attacker-controlled field to determine the repository format actually created. The vulnerability is remotely exploitable, mapped to `CWE-863`, and carries a **CVSS 4.0 score of 8.2**.
Aug 8, 2026