Nexus Repository 3 EUVD-2026-54516

Exploitation requires two concurrent conditions: first, the attacking account must hold the nexus:* wildcard permission, which is a high-privilege grant typically assigned to repository administrators or service accounts - this significantly limits the attacker pool to insiders or accounts already compromised through other means. Second, the local onboarding artifact must still be present on the Nexus Repository 3 server filesystem, which is the server-side gate the endpoint checks; on systems where onboarding completed but the artifact was not cleaned up, this condition is satisfied passively. There is no requirement for user interaction, and the endpoint is reachable over the network. Exploitation is bounded by the PR:H requirement: external unauthenticated attackers cannot trigger this without first obtaining nexus:* credentials through a separate compromise. The absence of session invalidation does not enable exploitation on its own but extends the impact window once the password change occurs.

The CVSS 4.0 score of 6.9 (Medium) reflects the realistic risk profile accurately: AV:N confirms the endpoint is network-reachable, AC:L and AT:N confirm no special conditions or timing requirements, but PR:H is the dominant limiting factor - exploitation requires an account already granted the nexus:* permission set, which represents a high level of pre-existing trust within the organization. The integrity impact (VI:H) is genuine: replacing the administrator password is a serious action that can result in full administrative control of the repository, including artifact tampering, credential harvesting from stored proxy credentials, and disruption of CI/CD pipelines. Confidentiality and availability impacts are assessed as none (VC:N/VA:N), consistent with the attack being an internal privilege escalation rather than external data exfiltration. No EPSS data was provided in the source intelligence. The vulnerability is not listed in the CISA KEV catalog and no public proof-of-concept exploit has been identified. The primary real-world risk is insider threat or post-compromise lateral movement: an attacker who has already compromised a nexus:* account can silently escalate to full administrator control and lock out legitimate administrators. The absence of session invalidation compounds this by allowing the attacker to operate while the legitimate admin remains unaware their credential has been rotated.

A developer or CI system account that has been granted the nexus:* permission - perhaps for plugin management or repository administration tasks - is used by a malicious insider or an attacker who has compromised that account. The attacker sends a crafted HTTP request to the onboarding password-change endpoint with a new administrator password of their choosing. The endpoint validates only that the local onboarding artifact is present, approves the change, and the attacker then authenticates as the Nexus administrator, gaining full control over all hosted, proxy, and group repositories including any stored credentials for remote registries. No public exploit code has been identified at time of analysis.