Nexus Repository 3 CVE-2026-17598

Exploitation requires an authenticated session in Sonatype Nexus Repository 3 with RBAC permission to create at least one scheduled task type through the administrative UI; full system-administrator rights are not required. The vulnerability is triggered solely via the task creation or update workflow in the admin UI - no API endpoint or file-system access is implied by available data. Anonymous or unauthenticated users cannot exploit this. Exploitation is further limited by the need for the attacker to know or enumerate valid identifiers of existing scheduled tasks in order to target a specific task's configuration for overwrite. Environments that restrict task-creation permissions to a small group of trusted administrators have a materially reduced attack surface.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L) scores 5.3, indicating moderate severity with low-complexity network exploitation requiring only a low-privileged account. No EPSS data was provided, no CISA KEV listing exists, and no public proof-of-concept has been identified, all suggesting this has not been weaponized at time of analysis. Real-world risk is highly context-dependent: in environments with strict RBAC where task-creation permissions are tightly controlled, the attack surface is narrow; in organizations where developers or junior administrators broadly hold task-creation rights, a malicious insider or compromised account could silently disable or corrupt critical automated tasks such as security scans, repository cleanups, or synchronization jobs. The CVSS integrity and availability impacts of 'Low' may understate the operational consequence if a targeted task underpins a compliance or security workflow. The availability of a vendor patch (3.95.0) and absence of active exploitation make this a prioritize-and-patch rather than emergency-response scenario.

An attacker with a Nexus Repository 3 account holding task-creation privileges crafts a task property value that embeds an internal configuration key referencing the identifier of an existing critical scheduled task - for example, a security scan or repository cleanup job. When submitted through the administrative UI's task creation or update workflow, the server overwrites the targeted task's configuration with the attacker-supplied values, potentially disabling it, altering its schedule, or corrupting its parameters, without requiring elevated administrative rights or any interaction from another user.