PatchTheCVEsonatype vulnerabilities
Recent CVEs affecting sonatype products. 5 tracked.
sonatype has 5 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 5. Most recent: 2026-08-07. Highest priority: CVE-2026-17603 (score 41/100).
- CVE-2026-17603 HIGH 8.8 UPGRADE Nexus Repository 3 did not sufficiently restrict which HikariCP connection-pool properties could be set throug
- CVE-2026-17600 HIGH 8.8 UPGRADE Sonatype Nexus Repository 3 did not immediately terminate a user's active login session or revoke their cached
- CVE-2026-17599 HIGH 7.2 UPGRADE Nexus Repository 3 contained an endpoint used to change the administrator account password during initial onbo
- CVE-2026-17601 HIGH 7.2 UPGRADE A user holding a permission to update privilege definitions could modify a wildcard privilege already assigned
- CVE-2026-17598 MEDIUM 4.9 UPGRADE Sonatype Nexus Repository 3 did not properly filter internal configuration keys from user-supplied task proper
FAQ
How do I fix sonatype vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is sonatype being exploited right now?
None of the tracked sonatype CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which sonatype CVE should I patch first?
CVE-2026-17603 currently ranks highest (41/100): Nexus Repository 3 did not sufficiently restrict which HikariCP connection-pool properties could be set throug.