Sonatype Nexus Security Advisory
Date: August 7, 2026
Affected Versions: All Sonatype Nexus Repository CE/Pro versions prior to 3.95.0
Fixed in Version: Sonatype Nexus Repository 3 CE/Pro version 3.95.0
CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N = 8.7 (High)
CWE: CWE-613: Insufficient Session Expiration
Sonatype Guide: https://guide.sonatype.com/vulnerability/CVE-2026-17600
Summary
Sonatype Nexus Repository 3 did not immediately terminate a user’s active login session or revoke their cached permissions when that user’s account was deleted, deactivated, or had its password changed. A user whose account was already logged in at the time of one of these actions could continue using their existing session to interact with the repository as though the account were still active, until that session independently expired. Depending on the permissions previously held, this could allow continued unauthorized access to read, modify, or delete repository content after access was intended to be revoked.
Recommendation
Upgrade to Sonatype Nexus Repository 3 CE/Pro version 3.95.0 or later. Downloads are available at https://help.sonatype.com/en/download.html
As a precaution, administrators who deleted, deactivated, or reset the password of any user account prior to upgrading should confirm that any sessions associated with that account are no longer active following the upgrade.
Credit
This issue was discovered and reported responsibly by Sanjok Karki (thesanjok) - https://sanjokkarki.com.np via Sonatype’s Bug Bounty Program.
Frequently Asked Questions
Q: What is the risk associated with this vulnerability?
A: A user whose account access was revoked (via deletion, deactivation, or a forced password change) could retain the ability to interact with the repository using their pre-existing session, including any read, write, or administrative capability their account held, until that session separately expired.
Q: What preconditions must be met in order to be vulnerable?
A: The user in question must have an existing, previously-established session at the time their account is deleted, deactivated, or has its password changed. There is no additional precondition beyond having logged in prior to the account action being taken.
Q: Are there implications associated with this advisory itself?
A: As with any public vulnerability disclosure, publishing this advisory increases awareness of the issue, including among potential bad actors. Organizations that have not yet upgraded should assess their exposure and apply the fix promptly.
Q: Why is Sonatype making this information available?
A: Sonatype follows a responsible disclosure process and proactively notifies customers of security issues so they can take appropriate action to protect their environments.