Sonatype Nexus Security Advisory
Date: August 7, 2026
Affected Versions: All previous Sonatype Nexus Repository CE/Pro versions from 2.8.0 up to and including 3.94.x
Fixed in Version: Sonatype Nexus Repository 3 CE/Pro version 3.95.0
CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N = 7.2 (High)
CWE: CWE-470: Use of Externally-Controlled Input to Select Classes or Code (Unsafe Reflection)
Sonatype Guide: https://guide.sonatype.com/vulnerability/CVE-2026-17593
Summary
A Nexus Repository 3 account holding the nexus:settings:update permission could submit arbitrary values as realm identifiers through an internal configuration API that did not validate them against the set of registered realms. Because unrecognized entries were persisted and re-evaluated on every restart via a legacy code path, this could result in unintended code executing inside the Nexus Repository 3 process, and in some cases a persistent authentication lockout that was not visible through the administrative UI.
Recommendation
Upgrade to Sonatype Nexus Repository 3 CE/Pro version 3.95.0 or later. Downloads are available at https://help.sonatype.com/en/download.html
As a precaution, after upgrading, review the accounts and roles granted the nexus:settings:update permission and confirm none were assigned inappropriately while running an affected version.
Immediate Mitigation Options
If you are unable to upgrade immediately:
- Restrict the
nexus:settings:updatepermission to trusted administrative roles only. - Review your configured realms (Administration > Security > Realms) for any unrecognized entries and remove them.
Credit
This issue was discovered and reported responsibly by Mayur Udiniya aka “roughwire” https://x.com/roughwire/ via Sonatype’s Bug Bounty Program.
Frequently Asked Questions
Q: What is the risk associated with this vulnerability?
A: An attacker meeting the required precondition could cause arbitrary code to execute inside the Nexus Repository process, or render the instance unable to authenticate any user after a restart.
Q: What preconditions must be met in order to be vulnerable?
A: The attacker must control an account granted the nexus:settings:update permission.
Q: Are there implications associated with this advisory itself?
A: As with any vulnerability disclosure, publishing details could help a bad actor identify and target unpatched systems. We strongly encourage all users to assess their environment and upgrade promptly.
Q: Why is Sonatype making this information available?
A: Sonatype follows a responsible disclosure process and proactively notifies the community of security issues so that users can take timely action to protect their systems.