Sonatype Nexus Security Advisory
Date: August 7, 2026
Affected Versions: All previous Sonatype Nexus Repository 3 CE/Pro versions 3.19.0 through 3.94.x
Fixed in Version: Sonatype Nexus Repository 3 CE/Pro version 3.95.0
CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N = 8.6 (High)
CWE: CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')
Sonatype Guide: https://guide.sonatype.com/vulnerability/CVE-2026-14644
Summary
Nexus Repository 3 contained a privilege escalation vulnerability in the REST privileges API. A user who has authenticated with valid credentials (i.e., not an anonymous/unauthenticated user) and holds permission to manage privileges could, under certain role configurations, escalate their own access to full administrator by exploiting a type-confusion flaw in the privilege update endpoint. Exploitation requires a valid, credentialed account with specific existing permissions and does not require user interaction.
Recommendation
Upgrade to Sonatype Nexus Repository 3 CE/Pro version 3.94.0 or later. Downloads are available at https://help.sonatype.com/en/download.html
Immediate Mitigation Options
If immediate upgrade is not possible:
- Review roles and restrict the
nx-privileges-updatepermission to fully trusted administrators only. - Audit custom (non-default) privileges and the roles they are assigned to, and remove unnecessary grants.
Credit
This issue was discovered and reported responsibly by Mayur Udiniya aka "roughwire" https://x.com/roughwire/ via Sonatype's Bug Bounty Program.
Frequently Asked Questions
Q: What is the risk associated with this vulnerability?
A: An attacker who successfully exploits this vulnerability can gain full administrator privileges over the Nexus Repository instance.
Q: What preconditions must be met in order to be vulnerable?
A: The attacker must already hold a valid, authenticated account — one that has supplied valid credentials, not an anonymous/unauthenticated user — with the nx-privileges-update permission and at least one custom, non-default privilege assigned to their own role.
Q: Are there implications associated with this advisory itself?
A: As with any public vulnerability disclosure, publishing this information could help a bad actor construct an exploit against instances that have not yet been patched. Sonatype recommends assessing your exposure and upgrading as soon as possible.
Q: Why is Sonatype making this information available?
A: Sonatype follows a responsible disclosure process, notifying and providing a fix to customers before publishing advisory details, in order to give users the information they need to protect their systems.