Which versions of Sonatype Nexus Repository are affected by CVE-2026-3329?

Sonatype Nexus Repository Manager is vulnerable to unauthenticated credential-guessing attacks due to missing rate-limiting on authentication endpoints (CVE-2026-3329, CVSS 8.7).. A patch is available.

How to fix or mitigate CVE-2026-3329?

Within 24 hours: Identify all Sonatype Nexus Repository Manager instances in your environment, review authentication logs for brute-force patterns, and confirm patch availability. Within 7 days: Apply the Sonatype-released patch to all instances and validate successful deployment. Within 30 days: Audit authentication logs for the past 90 days to identify potential unauthorized account access, reset passwords for administrative and service accounts, and implement IP-based access controls on Nexus authentication endpoints.

Sonatype Nexus Repository CVE-2026-3329

Q: What is the CVSS score of CVE-2026-3329?

CVE-2026-3329 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-36268 HIGH

Improper Restriction of Excessive Authentication Attempts (CWE-307)

2026-06-11 Sonatype

GHSA-pfx2-jf85-mvf2

Information Disclosure Nexus Repository Manager

8.7

CVSS 4.0 · Vendor: Sonatype

Severity by source

Vendor (Sonatype) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Network-reachable login endpoint with no rate-limiting allows unauthenticated guessing (AV:N/AC:L/PR:N/UI:N); successful guess discloses account credentials giving high confidentiality, with no direct integrity or availability impact on the platform.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Sonatype).

CVSS VectorVendor: Sonatype

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 11, 2026 - 18:15 vuln.today

DescriptionCVE.org

A remote unauthenticated attacker may be able to conduct credential-guessing attacks against user accounts in Sonatype Nexus Repository via authentication endpoints.

AnalysisAI

Credential-guessing attacks against Sonatype Nexus Repository Manager are enabled by missing rate-limiting on authentication endpoints, allowing remote unauthenticated attackers to brute-force or password-spray valid user accounts. The flaw stems from improper restriction of excessive authentication attempts (CWE-307) and carries a CVSS 4.0 base score of 8.7 reflecting high confidentiality impact; no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

Sonatype Nexus Repository Manager is a widely deployed artifact repository used to host Maven, npm, Docker, PyPI, NuGet and other build artifacts in CI/CD pipelines. The affected component is the authentication subsystem (login endpoints), where CWE-307 (Improper Restriction of Excessive Authentication Attempts) indicates the absence or insufficiency of lockout, throttling, or rate-limiting controls. CPE coverage cpe:2.3:a:sonatype:nexus_repository_manager:*:*:*:*:*:*:*:* indicates all unpatched versions of Nexus Repository 3 are potentially in scope; fixed code appears in release 3.93.0 per the Sonatype release notes.

RemediationAI

Vendor-released patch: 3.93.0 - upgrade Nexus Repository Manager to 3.93.0 or later as documented in the Sonatype release notes (https://help.sonatype.com/en/sonatype-nexus-repository-3-93-0-release-notes.html) and the support advisory (https://support.sonatype.com/hc/en-us/articles/52482870409491). Where immediate patching is not possible, place the Nexus UI and REST authentication endpoints behind an authenticating reverse proxy or WAF that enforces per-source rate limiting and account lockout, restrict network exposure of /service/rest/v1/security and the login endpoints to trusted CIDR ranges or VPN, enable SSO/SAML so that lockout is enforced upstream by the IdP, and rotate any credentials that were valid prior to mitigation; note that aggressive WAF rate limits can break legitimate CI agents that authenticate frequently, so allowlist build runner egress IPs.