Sonatype Nexus Repository CVE-2026-3048

Exploitation requires an authenticated session with administrator-level privileges in Nexus Repository Manager - the LDAP configuration and testing feature is restricted to administrators only (CVSS PR:H confirms this). The attacker must be able to direct Nexus to connect to an attacker-controlled LDAP server, meaning they either control the LDAP server endpoint entered in the configuration UI or can perform a man-in-the-middle attack on the existing LDAP connection. The LDAP configuration or test-connection workflow must be actively invoked; the vulnerability is not passively triggerable. Exploitation is limited to: (1) administrators acting maliciously or whose accounts are compromised, (2) environments where outbound network connections from the Nexus host to arbitrary LDAP endpoints are not restricted, and (3) Nexus instances running versions 3.0.0-3.91.1. Non-default LDAP configuration is a prerequisite in the sense that the attacker must be able to set or modify the LDAP server address.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N) scores 5.1 and correctly reflects the elevated privilege requirement (PR:H - admin-only) as the dominant risk-reduction factor. Real-world risk is further constrained by SSVC signals: exploitation=none, automatable=no, and technical impact=partial, collectively indicating no known active exploitation and a non-trivial attack path. EPSS at 0.04% (14th percentile) aligns with the low exploitation probability. The attack is not automatable because it requires deliberate administrative action - configuring or testing an LDAP endpoint pointing to an attacker-controlled server - meaning mass exploitation is not feasible. The scenario most relevant to defenders is a malicious insider (rogue admin) or a compromised admin account being leveraged to probe internal network services via SSRF. There is no conflicting data between CVSS and the description; the local-or-privileged-access gate is well-represented by PR:H. This is a real but bounded risk: organizations running Nexus with strict admin account controls and network egress filtering face materially lower exposure.

An attacker who has obtained administrator credentials for a Nexus Repository Manager instance (via credential theft, phishing, or insider access) navigates to the LDAP configuration panel and enters the address of an attacker-controlled LDAP server. Upon triggering a test connection, Nexus initiates an outbound connection to the malicious server; the server returns a crafted response containing malicious serialized data. Depending on the deserialization handling, this may allow the attacker to probe internal network services or achieve limited data manipulation, consistent with the VC:L/VI:L impact in the CVSS 4.0 vector. No public proof-of-concept exploit has been identified at time of analysis.