Nexus Repository 3 EUVD-2026-54515

Exploitation requires that the targeted user had an already-authenticated session open in Nexus Repository 3 at the moment the administrator performed an account deletion, deactivation, or password change. The exposure window is bounded by the session's natural expiration time - once the session expires, access is lost. This means exploitation is limited to a time-bounded window after the revocation event, not an indefinite backdoor. What limits exploitation: the attacker must be the account holder (or control it), must have had an active session at the precise moment of revocation, and cannot re-authenticate after the password change or account deletion. There is no exploitation path for a third party who never held valid credentials.

The CVSS 4.0 score of 8.7 with VC:H/VI:H/VA:H accurately reflects the potential damage once the precondition (an active session at the moment of revocation) is met. However, the real-world risk window is bounded: exploitation requires that the targeted user had an authenticated session open precisely when the admin acted, and the exposure closes when that session expires naturally. There is no CISA KEV listing and no reported POC, which lowers urgency compared to actively exploited flaws. EPSS data was not provided, making probability estimation incomplete. The PR:L metric confirms this is not an unauthenticated attack - an initial legitimate credential exchange must have occurred. For organizations handling sensitive supply-chain artifacts (internal Maven/npm/Docker registries), the integrity and availability impact (malicious package upload, content deletion) justifies treating this as a high-priority patch for any environment with terminated or suspicious accounts.

An employee with contributor access to an internal Maven repository is terminated; the IT team immediately deactivates the account in Nexus. However, the employee's CI pipeline token or browser session remains active. During the exposure window before session expiry, the former employee uploads a backdoored artifact version to a frequently-consumed internal library, affecting all downstream builds that pull the dependency. No public exploit code is known for this vulnerability.