Hard-coded credentials in Sonatype Nexus Repository Manager (CVE-2026-5189)

Sonatype Nexus Repository Manager 3.x contains a hard-coded credential in an internal database component that allows an unauthenticated attacker with network access to gain unauthorized read/write access to the internal database and execute arbitrary OS commands as the Nexus process user. Exploitation requires the OrientDB binary listener to be enabled, either explicitly via the nexus.orient.binaryListenerEnabled=true configuration setting or automatically in legacy HA-C clustering mode (nexus.clustered=true). Default standalone deployments and the current supported HA architecture are not affected. Affected versions: - 3.0.0 through 3.70.5 We recommend updating to: 3.71.0. CVSS 9.2 · our assessment: act_now Reference: https://support.sonatype.com/hc/en-us/articles/50817138825491 Details: https://vuln.today/cve/CVE-2026-5189