Sonatype

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in any Sonatype product.

RSS Feeds for Sonatype security vulnerabilities

Create a CVE RSS feed including security vulnerabilities found in Sonatype products with stack.watch. Just hit watch, then grab your custom RSS feed url.

Products by Sonatype Sorted by Most Security Vulnerabilities since 2018

Sonatype Nexus Repository Manager42 vulnerabilities

Sonatype Nexus7 vulnerabilities

Sonatype Nexus Repository Manager 33 vulnerabilities

Sonatype Nexus Iq Server1 vulnerability

Known Exploited Sonatype Vulnerabilities

The following Sonatype vulnerabilities have been marked by CISA as Known to be Exploited by threat actors.

Title	Description	Added
Sonatype Nexus Repository Manager Incorrect Access Control Vulnerability	Sonatype Nexus Repository Manager before 3.15.0 has an incorrect access control vulnerability. Exploitation allows for remote code execution. CVE-2019-7238 Exploit Probability: 76.5%	December 10, 2021
Nexus Repository Manager 3 Remote Code Execution Vulnerability	Sonatype Nexus Repository before 3.21.2 allows JavaEL Injection (issue 1 of 2). CVE-2020-10199 Exploit Probability: 99.1%	November 3, 2021

Of the known exploited vulnerabilities above, 2 are in the top 1%, or the 99th percentile of the EPSS exploit probability rankings.

By the Year

In 2026 there have been 15 vulnerabilities in Sonatype. Last year, in 2025 Sonatype had 2 security vulnerabilities published. That is, 13 more vulnerabilities have already been reported in 2026 as compared to last year.

Year	Vulnerabilities	Average Score
2026	15	0.00
2025	2	0.00
2024	1	6.50
2023	0	0.00
2022	2	4.30
2021	8	5.35
2020	9	6.80
2019	9	7.72
2018	6	6.30

It may take a day or so for new Sonatype vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Sonatype Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-14646	Jul 14, 2026	Nexus Repository 3 SSRF via Unfiltered HTTP Redirect Targets Nexus Repository 3 did not apply its existing Server-Side Request Forgery (SSRF) protections to HTTP redirect targets returned by proxy repository upstream servers. Any user with read access to a proxy repository backed by an attacker-controlled or compromised upstream server including an anonymous user, if anonymous access is enabled could receive a response from an internal network address or cloud metadata endpoint as repository content, potentially exposing sensitive information such as cloud IAM credentials.	Nexus Repository Manager
CVE-2026-14645	Jul 14, 2026	Nexus Repository 3 SSRF via Webhook: Global URL Nexus Repository 3 does not validate the destination of the "Webhook: Global" capability's configured URL before making an outbound HTTP request, allowing a user holding the Capability Administration permission to cause the server to send requests to internal network locations (Server-Side Request Forgery). This permission is granted by role assignment, independent of authentication status, so an unauthenticated user could also trigger this behavior if the anonymous role has been granted the permission.	Nexus Repository Manager
CVE-2026-14504	Jul 14, 2026	Auth Bypass: Nexus Repository 3 Upload API An authorization bypass in Nexus Repository 3's component upload API allowed a user with only read/browse privileges on a Swift, Terraform, or Conda hosted repository to upload arbitrary artifacts, bypassing the intended write-permission check.	Nexus Repository Manager
CVE-2026-7494	Jul 14, 2026	Nexus Repository SSRF via SSL Cert Retrieval (v3<3.94) Nexus Repository 3 is vulnerable to Server-Side Request Forgery (SSRF) via the SSL Certificate Retrieval endpoint. A user holding the nexus:ssl-truststore:read permission could cause the server to initiate outbound connections to internal or otherwise restricted network hosts. This issue affects Nexus Repository 3.0.0 through versions prior to 3.94.0.	Nexus Repository Manager
CVE-2026-11403	Jul 14, 2026	Unauthorized Access via API Key Generation in Sonatype Nexus Repo Manager A vulnerability in Sonatype Nexus Repository Manager's format-specific API key generation may allow a remote attacker to gain unauthorized access to repository operations as a targeted user. A format-specific API key realm (NuGet API Key, Docker Bearer Token, or npm Bearer Token) must be enabled and the targeted user must have an active API key for this vulnerability to be exploitable.	Nexus Repository Manager
CVE-2026-10741	Jun 17, 2026	Nexus Repo Manager <=3.92: proxy creds disclosure via auth bypass Sonatype Nexus Repository Manager before 3.93.0 contains an authorization vulnerability in the proxy repository configuration that allows a delegated repository administrator to disclose stored upstream proxy credentials.	Nexus Repository Manager
CVE-2026-10748	Jun 16, 2026	NX-Licensing upload RCE in Sonatype Nexus Repository <3.92.0 An authenticated user with the nx-licensing-create privilege can upload a specially crafted license file to execute arbitrary operating system commands as the Nexus process user in Sonatype Nexus Repository 3 versions before 3.92.0.	Nexus Repository Manager
CVE-2026-3329	Jun 11, 2026	Credential-guessing via authenticated endpoints in Sonatype Nexus Repository A remote unauthenticated attacker may be able to conduct credential-guessing attacks against user accounts in Sonatype Nexus Repository via authentication endpoints.	Nexus Repository Manager
CVE-2026-7308	May 11, 2026	XSS via Repository HTML Index in Nexus Repository 3.6.0-3.92.0 An authenticated user with upload permission to a hosted repository can store content that causes arbitrary JavaScript to execute in the browser of any user who browses that repository directory via the HTML index page in Sonatype Nexus Repository versions 3.6.0 through versions before 3.92.0. This could allow the attacker to perform actions in the context of the victim's session.	Nexus Repository Manager
CVE-2026-3048	May 11, 2026	Server-Side Connection Initiation in Nexus Repository Manager 3.x via LDAP Admin An authenticated administrator who configures or tests LDAP connectivity in Sonatype Nexus Repository Manager versions 3.0.0 through 3.91.1 may be able to initiate unintended server-side connections when interacting with a malicious LDAP server.	Nexus Repository Manager