Which versions of Nexus Repository are affected by CVE-2026-17593?

Sonatype Nexus Repository 3 contains a remote code execution vulnerability allowing authenticated administrators with settings update permissions to execute arbitrary code within the repository…. A patch is available.

How to fix or mitigate CVE-2026-17593?

Within 24 hours, inventory all Nexus Repository deployments and confirm whether any instances run versions below 3.95.0; simultaneously notify the development and infrastructure teams of the security exposure. Within 7 days, apply vendor-released patch Nexus Repository 3.95.0 to all affected instances, prioritizing production systems; for legacy Nexus Repository 2 deployments, verify patch availability with Sonatype and plan concurrent updates. Within 30 days, audit all accounts holding nexus:settings:update permission, remove unnecessary administrative access, and implement logging and monitoring for settings API activity to detect future anomalous configuration changes.

Nexus Repository CVE-2026-17593

Q: What is the CVSS score of CVE-2026-17593?

CVE-2026-17593 has a CVSS 4.0 base score of 7.2 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-54521 HIGH

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') (CWE-470)

2026-08-07 Sonatype

GHSA-rw8g-2688-625j

RCE Nexus Repository Sonatype

7.2

CVSS 4.0 · Vendor: Sonatype

Severity by source

Vendor (Sonatype) PRIMARY

7.2 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

PR:L reflects the required settings:update permission; RCE within the Nexus process implies full C/I/A despite vendor's VC:N rating.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Sonatype).

CVSS VectorVendor: Sonatype

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 07, 2026 - 16:48 vuln.today

CVE Published

Aug 07, 2026 - 16:07 cve.org

HIGH 7.2

DescriptionCVE.org

An account holding the nexus:settings:update permission in Nexus Repository 3 (or the equivalent nexus:settings permission in the legacy Nexus Repository 2) could submit arbitrary values as realm identifiers through an internal configuration API that did not validate them against the set of registered realms. Because unrecognized entries were persisted and re-evaluated on every realm load via a legacy code path, this could result in unintended code executing inside the Nexus Repository process, and in some cases a persistent authentication lockout that was not visible through the administrative UI.

AnalysisAI

Remote code execution in Sonatype Nexus Repository 3 (and legacy Nexus Repository 2) is achievable by any account holding the nexus:settings:update permission, which can submit arbitrary strings as realm identifiers to an internal configuration API that performs no validation against the registered realm set. Because unrecognized identifiers are persisted and re-evaluated on every realm load through a legacy code path (CWE-470, unsafe reflection), this allows unintended code to execute inside the Nexus Repository server process and can cause a persistent authentication lockout that is invisible through the administrative UI. A vendor-released patch is confirmed in Nexus Repository 3.95.0; no public exploit or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

Sonatype Nexus Repository implements a pluggable security realm architecture in which named realm identifiers are resolved to concrete implementations at load time. The internal configuration API responsible for updating the active realm list (CWE-470: Use of Externally-Controlled Input to Select Classes or Code, also known as unsafe reflection) fails to validate submitted identifiers against the registry of known, registered realms before persisting them. A legacy realm-loading code path then re-evaluates all persisted identifiers on each reload, including attacker-supplied values, which can cause the runtime to instantiate or invoke code corresponding to arbitrary class names or identifiers. The same flaw exists in the predecessor product Nexus Repository 2 under the nexus:settings permission. CPE cpe:2.3:a:sonatype:nexus_repository:*:*:*:*:*:*:*:* indicates all tracked versions are affected with no lower-bound exclusion confirmed in available data.

RemediationAI

Upgrade Nexus Repository 3 to version 3.95.0 or later, which contains the vendor-confirmed patch introducing validation of realm identifiers against the registered realm set before persistence; consult release notes at https://help.sonatype.com/en/sonatype-nexus-repository-3-95-0-release-notes.html and the advisory at https://support.sonatype.com/hc/en-us/articles/53849535836179/ for full guidance. For Nexus Repository 2 deployments, contact Sonatype directly via the advisory page, as a confirmed patch version for NR2 is not identified in available data. As a compensating control prior to patching, audit all role assignments and remove the nexus:settings:update (NR3) or nexus:settings (NR2) permission from any account that does not strictly require it, including CI/CD service accounts and non-administrative users; note this reduces attack surface but does not eliminate risk from legitimately privileged or already-compromised accounts. Additionally, review Nexus audit logs for unexpected changes to realm configuration and monitor for authentication failures that may indicate a lockout condition has been triggered.