Loading story…
Sonatype disclosed CVE-2026-10748, a high-severity remote code execution flaw in Nexus Repository 3 affecting versions before 3.92.0. The vulnerability stems from unsafe deserialization in license handling and allows an authenticated user with the nx-licensing-create privilege to upload a crafted license file and execute arbitrary operating system commands as the Nexus process user. The issue carries a CVSS 4.0 score of 8.6.
Organizations running Nexus Repository 3 are being urged to upgrade to 3.92.0 or later, apply vendor patches, and tightly restrict assignment of the nx-licensing-create privilege to reduce exposure. A separate F5 advisory also noted CVE-2026-42530 affecting the NGINX ngx_http_v3_module, but no technical synopsis was provided in the available reference.
See real exploitation activity before you spend the cycle.
1 event from the most recent confirmed update back to the earliest known activity.
A high-severity remote code execution vulnerability, CVE-2026-10748, was published affecting Sonatype Nexus Repository 3 before version 3.92.0. Sonatype indicated the flaw allows an authenticated user with the nx-licensing-create privilege to upload a crafted license file and execute arbitrary OS commands as the Nexus process user.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Sonatype disclosed two high-severity vulnerabilities in **Nexus Repository Manager 3** that can lead to arbitrary code execution. **`CVE-2026-3199`** affects versions **3.22.1 through 3.90.2** and allows an authenticated user with task creation privileges to execute code through task property injection in the task management component. The flaw bypasses the `nexus.scripts.allowCreation` security control, indicating a failure in script-related policy enforcement, and has been mapped to **`CWE-502`**. A second issue, **`CVE-2026-5189`**, affects versions **3.0.0 through 3.70.5** and stems from hard-coded credentials in an internal database component. If the non-default setting `nexus.orient.binaryListenerEnabled=true` is enabled, an unauthenticated network attacker can gain read and write access to the internal database and execute operating system commands as the Nexus process user. Sonatype linked the fixes to **Nexus Repository 3.91.0** for `CVE-2026-3199` and **3.71.0** for `CVE-2026-5189`, with both issues carrying high impact across confidentiality, integrity, and availability.
Jun 29, 2026
dCERT issued advisories for two vulnerabilities affecting **Sonatype Nexus Repository Manager**, warning that one flaw allows **cross-site scripting (XSS)** and another can **bypass security measures** and may lead to **potential code execution**. The issues affect a widely used artifact repository platform that often sits in software build and package distribution workflows. The paired advisories indicate risk ranging from browser-based compromise through XSS to more serious server-side impact if security controls can be circumvented. Organizations using Sonatype Nexus Repository Manager should review the relevant dCERT advisories, identify affected deployments, and prioritize vendor guidance and remediation to reduce exposure in development and supply-chain infrastructure.
Jun 29, 2026
Sonatype Nexus Repository 3 Community Edition and Pro contain a high-severity authorization flaw tracked as **CVE-2026-17594** that lets a user with delegated repository-admin rights for one repository format create a repository in a different, unauthorized format. The issue affects versions `3.0.0` through `3.94.x` and stems from the repository-creation workflow validating permissions against one request field while using a separate attacker-controlled field to determine the repository format actually created. The vulnerability is remotely exploitable, mapped to `CWE-863`, and carries a **CVSS 4.0 score of 8.2**.
Aug 8, 2026