Which versions of Nexus Repository 3 are affected by CVE-2026-14644?

A privilege escalation vulnerability in Sonatype Nexus Repository 3 (CVE-2026-14644, CVSS 8.6) allows authenticated users with specific privilege-management roles to escalate themselves to full…. A patch is available.

How to fix or mitigate CVE-2026-14644?

Within 24 hours, identify all instances of Sonatype Nexus Repository 3 in production and document their versions; simultaneously audit user accounts holding privilege-management roles to assess current exposure. Within 7 days, apply the vendor-released patch upgrading all affected instances to Nexus Repository 3.95.0, validating the upgrade in a non-production environment first. Within 30 days, implement a comprehensive access control review, restricting privilege-management role assignments to only those accounts requiring them, and establish monitoring for privilege escalation attempts.

Nexus Repository 3 CVE-2026-14644

Q: What is the CVSS score of CVE-2026-14644?

CVE-2026-14644 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-54522 HIGH

Access of Resource Using Incompatible Type (Type Confusion) (CWE-843)

2026-08-07 Sonatype

GHSA-ghg9-vwgf-3fv8

Privilege Escalation Memory Corruption Nexus Repository 3 Sonatype

8.6

CVSS 4.0 · Vendor: Sonatype

Severity by source

Vendor (Sonatype) PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.8 MEDIUM

AC:H reflects the 'certain role configurations' prerequisite not captured in the provided vector; PR:L because privilege-management delegation is required; no availability impact described.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Sonatype).

CVSS VectorVendor: Sonatype

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 07, 2026 - 16:49 vuln.today

CVE Published

Aug 07, 2026 - 16:07 cve.org

HIGH 8.6

DescriptionCVE.org

Nexus Repository 3 contained a privilege escalation vulnerability in the REST privileges API. An authenticated user with permission to manage privileges could, under certain role configurations, escalate their own access to full administrator by exploiting a type-confusion flaw in the privilege update endpoint.

AnalysisAI

Privilege escalation in Sonatype Nexus Repository 3 allows an authenticated user holding privilege-management rights to elevate their own access to full administrator by exploiting a type-confusion flaw (CWE-843) in the REST privilege update endpoint. Exploitation is constrained to specific role configurations, but the network-accessible attack surface and high confidentiality and integrity impact (VC:H/VI:H per the CVSS 4.0 vector) make this a meaningful insider or compromised-account risk in enterprise DevOps environments. A vendor-released patch is available in the Nexus Repository 3.95.0 release; no public exploit code or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

Sonatype Nexus Repository 3 is an artifact repository manager exposing a REST API for managing components, roles, and privileges, used widely across enterprise CI/CD pipelines. The affected component is the privilege update endpoint within the REST privileges API. CWE-843 (Access of Resource Using Incompatible Type, commonly called 'Type Confusion') indicates the endpoint fails to enforce consistent type-checking on the privilege object submitted during an update operation - allowing a caller to substitute an incompatible privilege type that the server processes with elevated authority. Despite the 'Memory Corruption' tag in the source intelligence, CWE-843 in an API context most commonly manifests as server-side logic confusion rather than a memory-safety exploit; however, memory-state effects at the language runtime level cannot be ruled out without source code review. The CPE string cpe:2.3:a:sonatype:nexus_repository_3:*:*:*:*:*:*:*:* covers all versions of Nexus Repository 3 with no bounded upper version, confirming the patch boundary falls within 3.95.0 per the referenced release notes.

RemediationAI

The primary remediation is upgrading Sonatype Nexus Repository 3 to version 3.95.0 or later, where the type-confusion flaw in the privilege update endpoint has been resolved per the vendor release notes at https://help.sonatype.com/en/sonatype-nexus-repository-3-95-0-release-notes.html and the accompanying advisory at https://support.sonatype.com/hc/en-us/articles/53157550694675. Organizations unable to upgrade immediately should audit and restrict which user accounts hold privilege-management permissions, applying the principle of least privilege to remove delegation from accounts that do not strictly require it - this directly eliminates the attack surface since exploitation requires that specific permission. Additionally, restrict network access to the Nexus REST API (default port 8081) to trusted internal networks or VPN-connected hosts, limiting exposure to the AV:N attack vector. Note that access controls applied via reverse proxy or firewall rules do not patch the underlying type-confusion flaw and should be treated as temporary compensating controls only.