Is there a patch available for CVE-2026-3048?

Yes, a patch is available for CVE-2026-3048. Update the affected software to the latest version immediately.

Sonatype Nexus Repository CVE-2026-3048

Q: What is the CVSS score of CVE-2026-3048?

CVE-2026-3048 has a CVSS 4.0 base score of 5.1 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-29094 MEDIUM

Deserialization of Untrusted Data (CWE-502)

2026-05-11 Sonatype

GHSA-q3x4-wr9j-7qg3

Deserialization Nexus Repository Sonatype

5.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.5 MEDIUM

AV:N because the LDAP config UI is network-accessible; PR:H for admin requirement; S:C because unintended connections reach systems beyond the Nexus boundary.

3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:L/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 23:58 vuln.today

CVE Published

May 11, 2026 - 17:11 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

An authenticated administrator who configures or tests LDAP connectivity in Sonatype Nexus Repository Manager versions 3.0.0 through 3.91.1 may be able to initiate unintended server-side connections when interacting with a malicious LDAP server.

AnalysisAI

Server-side request forgery with deserialization characteristics in Sonatype Nexus Repository Manager 3.0.0 through 3.91.1 allows an authenticated administrator to initiate unintended outbound connections from the Nexus host by configuring or testing LDAP connectivity against an attacker-controlled LDAP server. The root cause is classified as CWE-502 (Deserialization of Untrusted Data), indicating that malicious serialized payloads returned by the rogue LDAP server may be processed by the Nexus application, yielding limited confidentiality and integrity impact on the host. No public exploit has been identified and CISA has not listed this in KEV; Sonatype has released a fix in version 3.92.0.

Technical ContextAI

Sonatype Nexus Repository Manager provides a built-in LDAP integration feature, accessible to administrators, for configuring and testing directory service connectivity. The affected component processes LDAP server responses during configuration or connection testing. CWE-502 (Deserialization of Untrusted Data) indicates that the LDAP response handling involves deserializing objects returned by the remote server without sufficient validation - a well-documented attack surface in Java-based applications, where malicious LDAP responses can contain serialized Java objects or JNDI references that trigger unintended code paths or outbound connections. The affected CPE is cpe:2.3:a:sonatype:nexus_repository:*:*:*:*:*:*:*:* covering versions 3.0.0 through 3.91.1. This class of issue is related to Java deserialization gadget chains and LDAP-based JNDI injection patterns, though the confirmed impact here is limited to unintended server-side connections rather than full remote code execution.

RemediationAI

The primary remediation is upgrading Sonatype Nexus Repository Manager to version 3.92.0 or later, as documented in the release notes at https://help.sonatype.com/en/sonatype-nexus-repository-3-92-0-release-notes.html. If an immediate upgrade is not feasible, compensating controls should focus on restricting who holds administrative access to the Nexus instance and auditing LDAP configuration changes via access logs. Additionally, applying network-level egress filtering on the Nexus host to block outbound connections to non-approved LDAP endpoints (typically TCP 389/636) will prevent the unintended server-side connections even if the vulnerability is triggered - note this may disrupt legitimate LDAP testing workflows. Disabling the LDAP integration feature entirely via Nexus security realm configuration is a more disruptive but effective workaround if LDAP is not operationally required. Consult the Sonatype support advisory at https://support.sonatype.com/hc/en-us/articles/51591695462675 for vendor-specific guidance.