Skip to main content

Nexus Repository EUVDEUVD-2026-54521

| CVE-2026-17593 HIGH
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') (CWE-470)
2026-08-07 Sonatype GHSA-rw8g-2688-625j
RCE Nexus Repository
7.2
CVSS 4.0 · Vendor: Sonatype
Share

Severity by source

Vendor (Sonatype) PRIMARY
7.2 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
8.8 HIGH

PR:L reflects the required settings:update permission; RCE within the Nexus process implies full C/I/A despite vendor's VC:N rating.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Sonatype).

CVSS VectorVendor: Sonatype

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

2
Analysis Generated
Aug 07, 2026 - 16:48 vuln.today
CVE Published
Aug 07, 2026 - 16:07 cve.org
HIGH 7.2

DescriptionCVE.org

An account holding the nexus:settings:update permission in Nexus Repository 3 (or the equivalent nexus:settings permission in the legacy Nexus Repository 2) could submit arbitrary values as realm identifiers through an internal configuration API that did not validate them against the set of registered realms. Because unrecognized entries were persisted and re-evaluated on every realm load via a legacy code path, this could result in unintended code executing inside the Nexus Repository process, and in some cases a persistent authentication lockout that was not visible through the administrative UI.

AnalysisAI

Remote code execution in Sonatype Nexus Repository 3 (and legacy Nexus Repository 2) is achievable by any account holding the nexus:settings:update permission, which can submit arbitrary strings as realm identifiers to an internal configuration API that performs no validation against the registered realm set. Because unrecognized identifiers are persisted and re-evaluated on every realm load through a legacy code path (CWE-470, unsafe reflection), this allows unintended code to execute inside the Nexus Repository server process and can cause a persistent authentication lockout that is invisible through the administrative UI. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Obtain nexus:settings:update account credentials
Delivery
Submit crafted realm identifier to internal configuration API
Exploit
Malicious identifier persisted without validation
Execution
Realm reload event triggers legacy code path evaluation
Persist
Unintended code executes inside Nexus Repository process
Impact
Persistent authentication lockout or full RCE impact achieved
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires an authenticated account explicitly granted the nexus:settings:update permission in Nexus Repository 3, or the equivalent nexus:settings permission in Nexus Repository 2 - these are administrative-tier rights for managing security realm configuration and are not assigned to standard repository users by default. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H) scores 7.2, reflecting low-complexity network exploitation by a low-privileged account, with high integrity and availability impact but - notably - no confidentiality impact on the vulnerable system. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker who has obtained credentials for a Nexus service account with the nexus:settings:update permission - acquired via credential theft from a CI/CD pipeline secret store, an insider, or a phishing campaign targeting a Nexus administrator - submits a crafted realm identifier string to the internal Nexus configuration API. The value is persisted without validation, and on the next realm reload event the legacy code path evaluates the identifier, executing arbitrary code within the Nexus Repository server process. …
Remediation Upgrade Nexus Repository 3 to version 3.95.0 or later, which contains the vendor-confirmed patch introducing validation of realm identifiers against the registered realm set before persistence; consult release notes at https://help.sonatype.com/en/sonatype-nexus-repository-3-95-0-release-notes.html and the advisory at https://support.sonatype.com/hc/en-us/articles/53849535836179/ for full guidance. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, inventory all Nexus Repository deployments and confirm whether any instances run versions below 3.95.0; simultaneously notify the development and infrastructure teams of the security exposure. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Nexus Repository

View all
CVE-2026-5189 CRITICAL
9.2 Apr 15

Hard-coded credentials in Sonatype Nexus Repository 3.0.0 through 3.70.5 allow unauthenticated attackers with network ac
CVE-2026-10748 HIGH
8.6 Jun 16

Arbitrary OS command execution in Sonatype Nexus Repository 3 versions prior to 3.92.0 allows authenticated users holdin
CVE-2026-7494 MEDIUM
5.3 Jul 14

Server-Side Request Forgery in Sonatype Nexus Repository 3 exposes internal network infrastructure to authenticated user
CVE-2026-7308 MEDIUM
5.1 May 11

Stored cross-site scripting (XSS) in Sonatype Nexus Repository 3.6.0 through 3.91.x allows authenticated users with uplo
CVE-2026-3048 MEDIUM
5.1 May 11

Server-side request forgery with deserialization characteristics in Sonatype Nexus Repository Manager 3.0.0 through 3.91

Same weakness CWE-470 – Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

View all
CVE-2024-0200 CRITICAL POC
9.8
CVE-2024-4990 CRITICAL POC
9.1
CVE-2024-28121 HIGH POC
8.8
CVE-2023-33652 HIGH POC
8.8
CVE-2026-58659 HIGH POC
8.4
CVE-2022-30287 HIGH POC
8.0
CVE-2025-68455 HIGH POC
7.2
CVE-2026-25498 HIGH POC
7.2

Same technique RCE

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2017-7269 CRITICAL POC
9.8
CVE-2022-47966 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2023-3519 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8

Share

EUVD-2026-54521 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy