Sonatype

Known Exploited Sonatype Vulnerabilities

The following Sonatype vulnerabilities have been marked by CISA as Known to be Exploited by threat actors.

Of the known exploited vulnerabilities above, 2 are in the top 1%, or the 99th percentile of the EPSS exploit probability rankings.

By the Year

In 2026 there have been 35 vulnerabilities in Sonatype with an average score of 6.9 out of ten. Last year, in 2025 Sonatype had 2 security vulnerabilities published. That is, 33 more vulnerabilities have already been reported in 2026 as compared to last year.

Recent Sonatype Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-97712	Oct 15, 2026	Nexus Repository 3 Permission Misassignment Enables Privilege Escalation Sonatype Nexus Repository 3 allows a user that holds the role create or role update permission to grant roles and privileges that the account does not hold. This can give the user more access than intended, up to full administrative access.	Nexus Repository Manager
CVE-2026-97667	Oct 15, 2026	Stored Script Execution via R Package Metadata in Nexus Repository 3 Sonatype Nexus Repository 3 allows a user account that holds the edit permission on a hosted R repository to store script content in the metadata of an uploaded R package. The script runs in the browser of a user who opens the details of that package in the Browse user interface, with the permissions of the viewing user. In this description, a user account means an account that has supplied valid credentials. The anonymous user, if enabled, is also a user account and can hold this permission if an administrator grants it.	Nexus Repository Manager
CVE-2026-97666	Oct 15, 2026	Sonatype Nexus Repo 3 Java Class-Loading Leak via ExtDirect Sonatype Nexus Repository 3 allows an unauthenticated remote attacker to supply attacker-controlled input to a Java class loading call through an ExtDirect endpoint. This allows the attacker to learn whether specific classes are present in the application. The issue does not by itself allow code execution.	Nexus Repository Manager
CVE-2026-97665	Oct 15, 2026	CVE-2026-97665: Nexus Repository 3 Auth Bypass for .snupkg Upload A missing authorization check in Nexus Repository 3's NuGet Components API upload path allows an account holding only repository read and browse privileges to upload and persist NuGet symbol packages (.snupkg) to a hosted repository, bypassing the write-permission check enforced for ordinary package uploads. Exploitation requires a hosted NuGet repository with Symbol Server enabled. If anonymous access is enabled, the built-in anonymous user holds read and browse privileges across all repositories by default, so this precondition can also be met without an authenticated account.	Nexus Repository Manager
CVE-2026-77122	Sep 02, 2026	Nexus Repository 3 REST API Authorization Bypass via Repository Details Endpoint An authorization flaw in the REST API repository details endpoint (GET /service/rest/v1/repositories/{repositoryName}) in Sonatype Nexus Repository 3 allowed an account holding read or browse permission on a group repository to retrieve metadata for member repositories on which it held no direct permission, by requesting the endpoint directly for the member repository name. For proxy repositories, the disclosed metadata includes the configured remote URL, which may reveal internal upstream hostnames. This includes the anonymous user if it has been granted this permission; whether the anonymous user holds this permission depends on the role and permission configuration of the specific installation.	Nexus Repository Manager
CVE-2026-77124	Sep 02, 2026	Nexus Repository 3 Script exec endpoint bypass admin disable In affected versions of Nexus Repository 3, the script execution endpoint (POST /service/rest/v1/script/{name}/run) did not verify whether script execution had been administratively disabled. An account holding script-execution permission could continue to run previously-created scripts even after an administrator set nexus.scripts.allowCreation=false, undermining the expectation that this setting fully blocks script execution.	Nexus Repository Manager
CVE-2026-77123	Sep 02, 2026	Nexus Repository 3 Sensitive Disclosure via Capability API (CVE-2026-77123) Nexus Repository 3 contains a sensitive information disclosure vulnerability in the capability read API. An account holding the nexus:capabilities:read privilege can retrieve the plaintext shared secret configured on a webhook capability, which is intended to be masked from all API responses. This issue affects Nexus Repository 3 versions 3.2.0 through 3.95.x, and is fixed in version 3.96.0.	Nexus Repository Manager
CVE-2026-77121	Sep 02, 2026	Nexus Repo: Oversized POM Metadata Causes Permanent Browse Failures A user account with permission to deploy artifacts to a hosted Maven repository could upload a POM file containing an oversized metadata field. This causes future attempts to list or browse that repository's components to permanently fail until an administrator repairs the underlying data. Only the targeted repository is affected; other repositories and overall server health remain unaffected.	Nexus Repository Manager
CVE-2026-77125	Sep 02, 2026	Sonatype Nexus 3 Blobstore API Auth Bypass (nexus:blobstores:create) A vulnerability was identified in Sonatype Nexus Repository 3 in which two blobstore group management REST API endpoints did not correctly enforce the intended authorization check. A user granted only the nexus:blobstores:create permission could invoke these endpoints to convert an existing blobstore into a group blobstore, an action that should require the nexus:blobstores:update permission instead. This could result in unauthorized modification of blobstore configuration without administrator approval. The nexus:blobstores:create permission is a named permission that must be explicitly granted by an administrator; it is not held by default.	Nexus Repository Manager
CVE-2026-14644	Aug 07, 2026	Nexus Repository 3 Privilege Escalation via REST Privileges API Type-Confusion Nexus Repository 3 contained a privilege escalation vulnerability in the REST privileges API. An authenticated user with permission to manage privileges could, under certain role configurations, escalate their own access to full administrator by exploiting a type-confusion flaw in the privilege update endpoint.	Nexus Repository Manager