Which versions of Nexus Repository Manager are affected by CVE-2026-3199?

Sonatype Nexus Repository versions 3.22.1 through 3.90.2 contain a critical remote code execution vulnerability that allows authenticated users with task creation permissions to execute arbitrary…. A patch is available.

How to fix or mitigate CVE-2026-3199?

Within 24 hours: Identify all Nexus Repository instances running versions 3.22.1-3.90.2 and document task creation permission assignments. Restrict task creation permissions to essential personnel only and disable if unused. Within 7 days: Contact Sonatype for patch availability timeline and available workarounds; evaluate upgrade feasibility to version 3.90.3 or later if released. Within 30 days: Complete upgrade to patched version or implement compensating controls; conduct access review of all accounts with task creation permissions and audit recent task creation history for suspicious activity.

Nexus Repository Manager CVE-2026-3199

Q: What is the CVSS score of CVE-2026-3199?

CVE-2026-3199 has a CVSS 4.0 base score of 9.4 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-20756 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-04-08 103e4ec9-0a87-450b-af77-479448ddef11

GHSA-4685-c5cp-vp95

GHSA-48wf-g7cp-gr3m

GHSA-5f9p-f3w2-fwch

GHSA-6f6j-wx9w-ff4j

GHSA-cfvj-7rx7-fc7c

GHSA-fg3m-vhrr-8gj6

GHSA-gw85-xp4q-5gp9

GHSA-mqr9-vqhq-3jxw

GHSA-q399-23r3-hfx4

GHSA-w2wq-7mq5-mvww

GHSA-wm8r-w8pf-2v6w

RCE Deserialization Nexus Repository Manager Sonatype

9.4

CVSS 4.0 · Vendor: 103e4ec9-0a87-450b-af77-479448ddef11

Severity by source

Vendor (103e4ec9-0a87-450b-af77-479448ddef11) PRIMARY

9.4 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (103e4ec9-0a87-450b-af77-479448ddef11) · only source for this CVE.

CVSS VectorVendor: 103e4ec9-0a87-450b-af77-479448ddef11

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch released

Apr 09, 2026 - 02:30 nvd

Patch available

EUVD ID Assigned

Apr 08, 2026 - 23:24 euvd

EUVD-2026-20756

Analysis Generated

Apr 08, 2026 - 23:24 vuln.today

CVE Published

Apr 08, 2026 - 23:16 nvd

CRITICAL 9.4

DescriptionCVE.org

A vulnerability in the task management component of Sonatype Nexus Repository versions 3.22.1 through 3.90.2 allows an authenticated attacker with task creation permissions to execute arbitrary code, bypassing the nexus.scripts.allowCreation security control.

AnalysisAI

Remote code execution in Sonatype Nexus Repository 3.22.1-3.90.2 allows authenticated attackers with task creation permissions to execute arbitrary code via unsafe deserialization in the task management component. Exploitation bypasses the nexus.scripts.allowCreation security control, granting unauthorized code execution on the server. CVSS 9.4 (Critical). No public exploit identified at time of analysis. Attack requires low-privileged authentication (PR:L) and network access but no user interaction.

Technical ContextAI

CWE-502 deserialization flaw in task management permits malicious serialized object injection during task creation. Attack vector bypasses nexus.scripts.allowCreation configuration control, which normally restricts script execution. Unsafe deserialization enables arbitrary Java code execution within Nexus Repository runtime context, compromising server integrity and confidentiality.

RemediationAI

Vendor-released patch: upgrade to Sonatype Nexus Repository 3.91.0 or later, which addresses the deserialization vulnerability per official release notes (https://help.sonatype.com/en/sonatype-nexus-repository-3-91-0-release-notes.html). Review task creation permissions and restrict to trusted administrators only. Audit existing scheduled tasks for unauthorized entries. Consult vendor advisory for additional security hardening guidance: https://support.sonatype.com/hc/en-us/articles/50615414548499. No workaround exists; upgrading is the definitive remediation.