Vulnary
← back to the feed
Critical· 9.4

CVE-2026-3199

A flaw in Sonatype Nexus Repository’s task management lets a user with task‑creation rights run any code on the server. The bug bypasses a security setting that normally blocks script creation. It affects Nexus Repository versions 3.22.1 to 3.90.2.

publishedApr 8, 2026
last modifiedJul 25, 2026
sourcesNVD
severity · cvss
9.4
critical · how bad it is
exploitation · epss
<1%
38th percentile · chance of exploitation in 30 days
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →
auto-deletes from the system
counting…on Sep 8, 2026

No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.

01

Who is affected

Sonatype Nexus Repository 3.22.1 through 3.90.2, used by organizations that host software artifacts.

02

Real-world impact

An attacker who can create tasks could run malicious code on the machine that hosts Nexus, potentially taking full control of the server, stealing data, or using it for further attacks.

03

Why this severity

The CVSS score of 9.4 reflects that the vulnerability is exploitable over the network, requires low effort, and gives an attacker high privileges to run code with full system access. The high impact on confidentiality, integrity, and availability, combined with the low attack complexity, drives the critical rating.

04

What to do about it

no official fix yet
interim mitigations
  • Restrict task creation permissions to trusted users only; consider disabling task creation if not needed.

No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.

NVD description

05

Timeline

  1. Apr 8, 2026 · Apr 8, 2026
    Published
    Disclosed and added to the National Vulnerability Database.
  2. Jul 25, 2026 · 11d ago
    Advisory updated
    The NVD record was last revised.
06

How it’s attacked

Attack vectorNetwork (remote)
Attack complexityLow
Attack requirementsNone
Privileges requiredLow
User interactionNone needed
Confidentiality impactHigh
Integrity impactHigh
Availability impactHigh
07

References & advisories

(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →