PT-2026-69055 · Sonatype · Nexus Repository 3+1
CVE-2026-17593
·
Published
2026-08-07
·
Updated
2026-08-08
CVSS v4.0
7.2
High
| Vector | AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
Nexus Repository 3 (affected versions not specified)
Nexus Repository 2 (affected versions not specified)
Description
An account with the
nexus:settings:update permission in Nexus Repository 3, or the nexus:settings permission in Nexus Repository 2, can submit arbitrary values as realm identifiers through an internal configuration API. The system fails to validate these identifiers against registered realms. Since unrecognized entries are persisted and re-evaluated during every realm load via a legacy code path, this can lead to arbitrary code execution within the Nexus Repository process. Additionally, this may cause a persistent authentication lockout that is not visible through the administrative user interface.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Nexus Repository 2
Nexus Repository 3