Sonatype

Known Exploited Sonatype Vulnerabilities

The following Sonatype vulnerabilities have been marked by CISA as Known to be Exploited by threat actors.

Of the known exploited vulnerabilities above, 2 are in the top 1%, or the 99th percentile of the EPSS exploit probability rankings.

By the Year

In 2026 there have been 26 vulnerabilities in Sonatype with an average score of 7.2 out of ten. Last year, in 2025 Sonatype had 2 security vulnerabilities published. That is, 24 more vulnerabilities have already been reported in 2026 as compared to last year.

Recent Sonatype Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-14644	Aug 07, 2026	Nexus Repository 3 Privilege Escalation via REST Privileges API Type-Confusion Nexus Repository 3 contained a privilege escalation vulnerability in the REST privileges API. An authenticated user with permission to manage privileges could, under certain role configurations, escalate their own access to full administrator by exploiting a type-confusion flaw in the privilege update endpoint.	Nexus Repository Manager
CVE-2026-17593	Aug 07, 2026	Nexus Repository Manager 3: RM Code Exec via Unvalidated Realm IDs An account holding the nexus:settings:update permission in Nexus Repository 3 (or the equivalent nexus:settings permission in the legacy Nexus Repository 2) could submit arbitrary values as realm identifiers through an internal configuration API that did not validate them against the set of registered realms. Because unrecognized entries were persisted and re-evaluated on every realm load via a legacy code path, this could result in unintended code executing inside the Nexus Repository process, and in some cases a persistent authentication lockout that was not visible through the administrative UI.	Nexus Repository Manager
CVE-2026-17595	Aug 07, 2026	Nexus Repository 3 JEXL Sandbox Bypass Exposes JVM Class Metadata Nexus Repository 3 did not fully sandbox JEXL expressions used in Content Selectors. An account holding the nexus:selectors:create permission could construct an expression that read Java object properties not intended to be exposed to the expression engine, disclosing internal JVM class metadata such as class and classloader names. This issue does not permit method invocation, object construction, or arbitrary code execution. This has been fixed by restricting property access in the JEXL sandbox to the intended data types.	Nexus Repository Manager
CVE-2026-17596	Aug 07, 2026	Nexus Repo 3 XSS via Storing Blob Store Name (fixed in 3.95.0) Nexus Repository 3 was found to be vulnerable to stored cross-site scripting (XSS). A user with the nexus:blobstores:create or nexus:blobstores:update permission could set a blob store name containing malicious script content, which would later execute in the browser of another user viewing system health-check status. This issue has been fixed in version 3.95.0.	Nexus Repository Manager
CVE-2026-17594	Aug 07, 2026	Nexus Repository 3 <=3.94.x: repo-creation privilege escalation Nexus Repository 3 CE/Pro versions 3.0.0 through 3.94.x contain an incorrect authorization vulnerability (CWE-863) in the repository-creation user interface. An individual user account holding a delegated repository-admin privilege scoped to a specific repository format could create a repository of a different, unauthorized format, because authorization was checked against one request field while a separate, attacker-controlled field determined the repository format actually created. This does not affect the anonymous user, which cannot hold this privilege by default. Fixed in version 3.95.0.	Nexus Repository Manager
CVE-2026-17598	Aug 07, 2026	Sonatype Nexus Repo 3 Config Overwrite via Task Properties Sonatype Nexus Repository 3 did not properly filter internal configuration keys from user-supplied task properties when creating or updating a scheduled task through the administrative UI. An account holding permission to create at least one scheduled task type could supply a crafted property value that caused the system to overwrite the configuration of an unrelated, existing task instead of creating a new one.	Nexus Repository Manager
CVE-2026-17597	Aug 07, 2026	Nexus Repository 3 SSRF via Email Config (3.94.1, fixed 3.95.0) Nexus Repository 3 contains a Server-Side Request Forgery (SSRF) vulnerability in the email configuration verification feature. A user holding the nexus:settings:update permission could submit arbitrary host and port values to the email test/verification endpoint, causing the server to attempt outbound network connections to internal or otherwise restricted network addresses. Differences in the server's response could be used to infer whether internal hosts and ports are reachable. This issue affects Nexus Repository 3 CE/Pro versions up to and including 3.94.1, and is fixed in version 3.95.0.	Nexus Repository Manager
CVE-2026-17603	Aug 07, 2026	Nexus Repository 3: HikariCP Connection Property RCE via DataStore API Nexus Repository 3 did not sufficiently restrict which HikariCP connection-pool properties could be set through the DataStore configuration API. A user holding the nx-datastores-update permission could set the connectionInitSql property to execute arbitrary SQL against the configured database on every new connection. On the default H2 database backend, this could be leveraged to achieve remote code execution as the Nexus process user.	Nexus Repository Manager
CVE-2026-17600	Aug 07, 2026	Sonatype Nexus Repo 3 Session Persistence on Account Deletion Sonatype Nexus Repository 3 did not immediately terminate a user's active login session or revoke their cached permissions when that user's account was deleted, deactivated, or had its password changed. A user whose account was already logged in at the time of one of these actions could continue using their existing session to interact with the repository as though the account were still active, until that session independently expired. Depending on the permissions previously held, this could allow continued unauthorized access to read, modify, or delete repository content after access was intended to be revoked.	Nexus Repository Manager
CVE-2026-17599	Aug 07, 2026	Unprotected Admin Password Reset Endpoint in Nexus Repository 3 Nexus Repository 3 contained an endpoint used to change the administrator account password during initial onboarding. This endpoint did not verify that onboarding was still in progress before allowing the password change, relying instead on the presence of a local onboarding artifact. As a result, an account holding the nexus:* permission could invoke the endpoint outside the intended onboarding flow to replace the administrator password, and existing sessions were not invalidated after the change.	Nexus Repository Manager