Sonatype

Known Exploited Sonatype Vulnerabilities

The following Sonatype vulnerabilities have been marked by CISA as Known to be Exploited by threat actors.

Of the known exploited vulnerabilities above, 2 are in the top 1%, or the 99th percentile of the EPSS exploit probability rankings.

By the Year

In 2026 there have been 31 vulnerabilities in Sonatype with an average score of 6.9 out of ten. Last year, in 2025 Sonatype had 2 security vulnerabilities published. That is, 29 more vulnerabilities have already been reported in 2026 as compared to last year.

Recent Sonatype Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-77122	Sep 02, 2026	Nexus Repository 3 REST API Authorization Bypass via Repository Details Endpoint An authorization flaw in the REST API repository details endpoint (GET /service/rest/v1/repositories/{repositoryName}) in Sonatype Nexus Repository 3 allowed an account holding read or browse permission on a group repository to retrieve metadata for member repositories on which it held no direct permission, by requesting the endpoint directly for the member repository name. For proxy repositories, the disclosed metadata includes the configured remote URL, which may reveal internal upstream hostnames. This includes the anonymous user if it has been granted this permission; whether the anonymous user holds this permission depends on the role and permission configuration of the specific installation.	Nexus Repository Manager
CVE-2026-77124	Sep 02, 2026	Nexus Repository 3 Script exec endpoint bypass admin disable In affected versions of Nexus Repository 3, the script execution endpoint (POST /service/rest/v1/script/{name}/run) did not verify whether script execution had been administratively disabled. An account holding script-execution permission could continue to run previously-created scripts even after an administrator set nexus.scripts.allowCreation=false, undermining the expectation that this setting fully blocks script execution.	Nexus Repository Manager
CVE-2026-77123	Sep 02, 2026	Nexus Repository 3 Sensitive Disclosure via Capability API (CVE-2026-77123) Nexus Repository 3 contains a sensitive information disclosure vulnerability in the capability read API. An account holding the nexus:capabilities:read privilege can retrieve the plaintext shared secret configured on a webhook capability, which is intended to be masked from all API responses. This issue affects Nexus Repository 3 versions 3.2.0 through 3.95.x, and is fixed in version 3.96.0.	Nexus Repository Manager
CVE-2026-77121	Sep 02, 2026	Nexus Repo: Oversized POM Metadata Causes Permanent Browse Failures A user account with permission to deploy artifacts to a hosted Maven repository could upload a POM file containing an oversized metadata field. This causes future attempts to list or browse that repository's components to permanently fail until an administrator repairs the underlying data. Only the targeted repository is affected; other repositories and overall server health remain unaffected.	Nexus Repository Manager
CVE-2026-77125	Sep 02, 2026	Sonatype Nexus 3 Blobstore API Auth Bypass (nexus:blobstores:create) A vulnerability was identified in Sonatype Nexus Repository 3 in which two blobstore group management REST API endpoints did not correctly enforce the intended authorization check. A user granted only the nexus:blobstores:create permission could invoke these endpoints to convert an existing blobstore into a group blobstore, an action that should require the nexus:blobstores:update permission instead. This could result in unauthorized modification of blobstore configuration without administrator approval. The nexus:blobstores:create permission is a named permission that must be explicitly granted by an administrator; it is not held by default.	Nexus Repository Manager
CVE-2026-14644	Aug 07, 2026	Nexus Repository 3 Privilege Escalation via REST Privileges API Type-Confusion Nexus Repository 3 contained a privilege escalation vulnerability in the REST privileges API. An authenticated user with permission to manage privileges could, under certain role configurations, escalate their own access to full administrator by exploiting a type-confusion flaw in the privilege update endpoint.	Nexus Repository Manager
CVE-2026-17593	Aug 07, 2026	Nexus Repository Manager 3: RM Code Exec via Unvalidated Realm IDs An account holding the nexus:settings:update permission in Nexus Repository 3 (or the equivalent nexus:settings permission in the legacy Nexus Repository 2) could submit arbitrary values as realm identifiers through an internal configuration API that did not validate them against the set of registered realms. Because unrecognized entries were persisted and re-evaluated on every realm load via a legacy code path, this could result in unintended code executing inside the Nexus Repository process, and in some cases a persistent authentication lockout that was not visible through the administrative UI.	Nexus Repository Manager
CVE-2026-17595	Aug 07, 2026	Nexus Repository 3 JEXL Sandbox Bypass Exposes JVM Class Metadata Nexus Repository 3 did not fully sandbox JEXL expressions used in Content Selectors. An account holding the nexus:selectors:create permission could construct an expression that read Java object properties not intended to be exposed to the expression engine, disclosing internal JVM class metadata such as class and classloader names. This issue does not permit method invocation, object construction, or arbitrary code execution. This has been fixed by restricting property access in the JEXL sandbox to the intended data types.	Nexus Repository Manager
CVE-2026-17596	Aug 07, 2026	Nexus Repo 3 XSS via Storing Blob Store Name (fixed in 3.95.0) Nexus Repository 3 was found to be vulnerable to stored cross-site scripting (XSS). A user with the nexus:blobstores:create or nexus:blobstores:update permission could set a blob store name containing malicious script content, which would later execute in the browser of another user viewing system health-check status. This issue has been fixed in version 3.95.0.	Nexus Repository Manager
CVE-2026-17594	Aug 07, 2026	Nexus Repository 3 <=3.94.x: repo-creation privilege escalation Nexus Repository 3 CE/Pro versions 3.0.0 through 3.94.x contain an incorrect authorization vulnerability (CWE-863) in the repository-creation user interface. An individual user account holding a delegated repository-admin privilege scoped to a specific repository format could create a repository of a different, unauthorized format, because authorization was checked against one request field while a separate, attacker-controlled field determined the repository format actually created. This does not affect the anonymous user, which cannot hold this privilege by default. Fixed in version 3.95.0.	Nexus Repository Manager