CVE-2026-17599

Name of the Vulnerable Software and Affected Versions Nexus Repository 3 (affected versions not specified)

Description An endpoint used to change the administrator account password during initial onboarding fails to verify if the onboarding process is still active, relying only on a local onboarding artifact. This allows an account with the nexus:* permission to invoke the endpoint outside the intended flow to replace the administrator password. Additionally, existing sessions are not invalidated after the password is changed.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.