Loading story…
Sonatype Nexus Repository 3 Community Edition and Pro contain a high-severity authorization flaw tracked as CVE-2026-17594 that lets a user with delegated repository-admin rights for one repository format create a repository in a different, unauthorized format. The issue affects versions 3.0.0 through 3.94.x and stems from the repository-creation workflow validating permissions against one request field while using a separate attacker-controlled field to determine the repository format actually created. The vulnerability is remotely exploitable, mapped to CWE-863, and carries a CVSS 4.0 score of 8.2.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
On August 7, 2026, the CVE record for CVE-2026-17594 was published, describing a remotely exploitable incorrect authorization flaw affecting Sonatype Nexus Repository 3 versions 3.0.0 through 3.94.x. The entry assigned the issue a CVSS 4.0 score of 8.2 and mapped it to CWE-863.
A GitHub pull request published proof-of-concept exploitation details and a Nuclei template for CVE-2026-17594, showing successful unauthorized raw repository creation on Nexus Repository 3.94.1-06 and failure to reproduce on 3.95.0-07. The material documented the vulnerable RepositoryUiService.create() flow and included sample exploit and validation output.
Sonatype fixed CVE-2026-17594, an authorization bypass in Nexus Repository 3 that lets a delegated repository admin create a repository of an unauthorized format. The remediation is to upgrade to Nexus Repository Manager 3.95.0 or later.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Sonatype disclosed two high-severity vulnerabilities in **Nexus Repository Manager 3** that can lead to arbitrary code execution. **`CVE-2026-3199`** affects versions **3.22.1 through 3.90.2** and allows an authenticated user with task creation privileges to execute code through task property injection in the task management component. The flaw bypasses the `nexus.scripts.allowCreation` security control, indicating a failure in script-related policy enforcement, and has been mapped to **`CWE-502`**. A second issue, **`CVE-2026-5189`**, affects versions **3.0.0 through 3.70.5** and stems from hard-coded credentials in an internal database component. If the non-default setting `nexus.orient.binaryListenerEnabled=true` is enabled, an unauthenticated network attacker can gain read and write access to the internal database and execute operating system commands as the Nexus process user. Sonatype linked the fixes to **Nexus Repository 3.91.0** for `CVE-2026-3199` and **3.71.0** for `CVE-2026-5189`, with both issues carrying high impact across confidentiality, integrity, and availability.
Jun 29, 2026
Sonatype disclosed **CVE-2026-10748**, a high-severity remote code execution flaw in **Nexus Repository 3** affecting versions before **3.92.0**. The vulnerability stems from unsafe deserialization in license handling and allows an authenticated user with the `nx-licensing-create` privilege to upload a crafted license file and execute arbitrary operating system commands as the Nexus process user. The issue carries a **CVSS 4.0 score of 8.6**. Organizations running Nexus Repository 3 are being urged to upgrade to **3.92.0 or later**, apply vendor patches, and tightly restrict assignment of the `nx-licensing-create` privilege to reduce exposure. A separate F5 advisory also noted **CVE-2026-42530** affecting the **NGINX `ngx_http_v3_module`**, but no technical synopsis was provided in the available reference.
Jun 29, 2026
dCERT issued advisories for two vulnerabilities affecting **Sonatype Nexus Repository Manager**, warning that one flaw allows **cross-site scripting (XSS)** and another can **bypass security measures** and may lead to **potential code execution**. The issues affect a widely used artifact repository platform that often sits in software build and package distribution workflows. The paired advisories indicate risk ranging from browser-based compromise through XSS to more serious server-side impact if security controls can be circumvented. Organizations using Sonatype Nexus Repository Manager should review the relevant dCERT advisories, identify affected deployments, and prioritize vendor guidance and remediation to reduce exposure in development and supply-chain infrastructure.
Jun 29, 2026