Which versions of Sonatype Nexus Repository are affected by CVE-2026-10748?

Sonatype Nexus Repository 3 (versions before 3.92.0) contains a privilege escalation vulnerability allowing users with licensing administration privileges to execute arbitrary commands on the…. A patch is available.

How to fix or mitigate CVE-2026-10748?

Within 24 hours: Inventory all Sonatype Nexus Repository 3 instances and current versions; audit access logs for users with nx-licensing-create privilege; restrict licensing file upload permissions pending patching. Within 7 days: Apply patch to Sonatype Nexus Repository 3.92.0 or later on at least one staging instance and verify functionality. Within 30 days: Complete patch deployment to all production Nexus Repository instances and audit nx-licensing-create privilege assignments for necessity.

Sonatype Nexus Repository CVE-2026-10748

Q: What is the CVSS score of CVE-2026-10748?

CVE-2026-10748 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-37139 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-06-16 Sonatype

GHSA-mfx4-8g7q-p97w

Deserialization Nexus Repository

8.6

CVSS 4.0 · Vendor: Sonatype

Severity by source

Vendor (Sonatype) PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.2 HIGH

Network-reachable web upload (AV:N/AC:L), no user interaction, but requires the high-privilege nx-licensing-create role (PR:H); deserialization yields full RCE as Nexus user, giving C/I/A:H without scope change.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Sonatype).

CVSS VectorVendor: Sonatype

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 18:58 vuln.today

DescriptionCVE.org

An authenticated user with the nx-licensing-create privilege can upload a specially crafted license file to execute arbitrary operating system commands as the Nexus process user in Sonatype Nexus Repository 3 versions before 3.92.0.

AnalysisAI

Arbitrary OS command execution in Sonatype Nexus Repository 3 versions prior to 3.92.0 allows authenticated users holding the nx-licensing-create privilege to run commands as the Nexus process user by uploading a malicious license file. The flaw is rooted in unsafe deserialization (CWE-502) during license processing. No public exploit identified at time of analysis.

Technical ContextAI

Sonatype Nexus Repository 3 is a widely deployed binary artifact manager used in CI/CD pipelines for storing Maven, npm, Docker, NuGet, and other package formats. The vulnerability class is CWE-502 (Deserialization of Untrusted Data), and the 'Deserialization' tag plus the license-file upload vector strongly suggest that the license parser deserializes attacker-controlled object data without sufficient type or class restrictions, a recurring pattern in Java application servers. The affected CPE cpe:2.3:a:sonatype:nexus_repository covers the Nexus Repository 3 product line up to (but not including) 3.92.0.

RemediationAI

Vendor-released patch: upgrade to Sonatype Nexus Repository 3.92.0 or later, per the 3.92.0 release notes (https://help.sonatype.com/en/sonatype-nexus-repository-3-92-0-release-notes.html) and the Sonatype advisory (https://support.sonatype.com/hc/en-us/articles/52335766035603). Until the upgrade is completed, audit and minimize accounts holding the nx-licensing-create privilege (revoke from any non-administrative role and from service accounts), rotate administrator credentials, and enforce MFA/SSO on the Nexus UI; the trade-off is operational friction for legitimate license updates, which will require a temporarily designated admin to perform. Additionally, restrict network exposure of the Nexus UI/API to trusted CI/CD networks or via a reverse-proxy ACL - this blocks opportunistic credential-stuffing but will break any external integrations that authenticate directly to the instance.