Sonatype Nexus vulnerabilities and fixes

CVEs that mention Sonatype Nexus, ranked by priority. 5 tracked.

Sonatype Nexus has 5 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 5. Most recent: 2026-08-07. Highest priority: CVE-2026-17603 (score 41/100).

• CVE-2026-17603 HIGH 8.8 UPGRADE Nexus Repository 3 did not sufficiently restrict which HikariCP connection-pool properties could be set throug
• CVE-2026-17600 HIGH 8.8 UPGRADE Sonatype Nexus Repository 3 did not immediately terminate a user's active login session or revoke their cached
• CVE-2026-17599 HIGH 7.2 UPGRADE Nexus Repository 3 contained an endpoint used to change the administrator account password during initial onbo
• CVE-2026-17601 HIGH 7.2 UPGRADE A user holding a permission to update privilege definitions could modify a wildcard privilege already assigned
• CVE-2026-17598 MEDIUM 4.9 UPGRADE Sonatype Nexus Repository 3 did not properly filter internal configuration keys from user-supplied task proper

FAQ

How do I fix Sonatype Nexus vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is Sonatype Nexus being exploited right now?

None of the tracked Sonatype Nexus CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which Sonatype Nexus CVE should I patch first?

CVE-2026-17603 currently ranks highest (41/100): Nexus Repository 3 did not sufficiently restrict which HikariCP connection-pool properties could be set throug.

← Back to latest CVEs