Is there a patch available for CVE-2026-7494?

Yes, a patch is available for CVE-2026-7494. Update the affected software to the latest version immediately.

Nexus Repository CVE-2026-7494

Q: What is the CVSS score of CVE-2026-7494?

CVE-2026-7494 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-43744 MEDIUM

Server-Side Request Forgery (SSRF) (CWE-918)

2026-07-14 Sonatype

GHSA-jpvp-vqx9-22qg

SSRF Nexus Repository Sonatype

5.3

CVSS 4.0 · Vendor: Sonatype

Severity by source

Vendor (Sonatype) PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.0 MEDIUM

Network-reachable endpoint exploitable by low-privilege users; scope change to subsequent systems captures internal SSRF pivot; no confidentiality or integrity impact on the Nexus host itself.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N

Primary rating from Vendor (Sonatype).

CVSS VectorVendor: Sonatype

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 16:35 vuln.today

CVE Published

Jul 14, 2026 - 15:46 cve.org

MEDIUM 5.3

DescriptionCVE.org

Nexus Repository 3 is vulnerable to Server-Side Request Forgery (SSRF) via the SSL Certificate Retrieval endpoint. A user holding the nexus:ssl-truststore:read permission could cause the server to initiate outbound connections to internal or otherwise restricted network hosts. This issue affects Nexus Repository 3.0.0 through versions prior to 3.94.0.

AnalysisAI

Server-Side Request Forgery in Sonatype Nexus Repository 3 exposes internal network infrastructure to authenticated users holding the nexus:ssl-truststore:read permission, who can weaponize the SSL Certificate Retrieval endpoint to force the server to initiate outbound TCP connections to arbitrary hosts - including cloud metadata services, internal APIs, and otherwise firewalled systems. All versions from 3.0.0 up to (but not including) 3.94.0 are affected, and a vendor-released patch is available. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

Sonatype Nexus Repository 3 is an enterprise artifact repository manager supporting Maven, npm, Docker, PyPI, and other package formats, widely deployed in CI/CD pipelines. It exposes an SSL Certificate Retrieval endpoint intended to allow administrators to fetch remote TLS certificates for import into the server's trust store. CWE-918 (Server-Side Request Forgery) arises when the server uses attacker-controlled input - here the target hostname or URL supplied to that endpoint - to construct and execute outbound network requests without sufficient validation or allow-listing. The affected CPE is cpe:2.3:a:sonatype:nexus_repository:*:*:*:*:*:*:*:*, covering all 3.x releases before 3.94.0. An attacker exploiting this can leverage the Nexus server as a network pivot to probe internal services that are not directly reachable from the attacker's location.

RemediationAI

Upgrade Sonatype Nexus Repository to version 3.94.0 or later, as documented in the official release notes at https://help.sonatype.com/en/sonatype-nexus-repository-3-94-0-release-notes.html. If an immediate upgrade is not possible, restrict the nexus:ssl-truststore:read permission to only trusted administrators who genuinely require trust store management capabilities, reducing the population of users who can trigger the vulnerable endpoint - note that this is a configuration change with an operational trade-off if broader teams currently manage certificates. As a network-layer control, implement egress filtering on the host running Nexus to restrict outbound connections to an explicit allow-list of known external certificate authorities and approved endpoints, blocking access to RFC 1918 address space and cloud metadata addresses (e.g., 169.254.169.254); this mitigates the internal pivot risk but may break legitimate certificate retrieval workflows and requires careful allow-list maintenance.