Nexus Repository 3 CVE-2026-17603

Exploitation requires a valid Nexus Repository 3 account with the nx-datastores-update permission explicitly granted - anonymous or standard read-only users cannot exploit this vulnerability. The DataStore configuration API must be reachable over the network (standard in most deployments). Full RCE escalation specifically requires the target instance to be running the default H2 embedded database backend; if an external database is configured, the attacker can still inject arbitrary SQL against that database (subject to its execution capabilities and the configured user's privileges), but OS-level command execution is not guaranteed. No user interaction by a victim is required beyond the attacker's own API call - the malicious SQL fires automatically when HikariCP opens a new connection. Limiting factors include: the nx-datastores-update permission is not granted to all authenticated users by default (CVSS PR:L implies at least some role assignment is required); instances using hardened external databases with restricted SQL privileges reduce the RCE impact.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N, score 8.7) accurately reflects the risk profile. PR:L correctly captures that exploitation requires the nx-datastores-update permission - not anonymous access, but a non-administrative role that may be broadly assigned in large DevOps teams or misconfigured RBAC environments. Attack complexity is genuinely low: once the permission is held, the technique requires only a single API request to set the property, and the SQL fires automatically on the next connection pool event. No EPSS data was provided, and this CVE does not appear in the CISA KEV catalog, so active exploitation is unconfirmed at time of analysis. The absence of a KEV listing should not be treated as a signal of low risk - the attack technique leverages H2's well-documented Java execution capabilities, meaning a capable attacker could weaponize this without novel research. The practical priority is high for organizations where Nexus Repository 3 is internet-exposed or where the nx-datastores-update permission is broadly assigned; it is medium for air-gapped or tightly RBAC-controlled deployments.

An attacker with a Nexus account holding the nx-datastores-update role permission sends a crafted PUT or POST request to the DataStore configuration API, embedding a connectionInitSql value containing malicious H2 SQL that invokes a Java Runtime.exec() call. On the next HikariCP connection pool event - triggered automatically by normal Nexus operation - the SQL executes against the H2 backend, spawning an OS process as the Nexus service account. No public proof-of-concept has been identified at time of analysis, but the H2 SQL-to-JVM-execution technique is well-documented in prior CVEs affecting other products using H2.