CVE-2026-17599: medium-severity vulnerability in Sonatype Nexus Repository 3
Nexus Repository 3 - Unverified Onboarding State on change-admin-password Endpoint
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.9epss 0.5%
Nexus Repository 3 contained an endpoint used to change the administrator account password during initial onboarding. This endpoint did not verify that onboarding was still in progress before allowing the password change, relying instead on the presence of a local onboarding artifact. As a result, an account holding the nexus:* permission could invoke the endpoint outside the intended onboarding flow to replace the administrator password, and existing sessions were not invalidated after the change.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Affected products
Sonatype · Nexus Repository 3Related CVEs — Sonatype Nexus Repository 3
In the same product, most dangerous first.
CVE-2026-17594HIGHNexus Repository 3 - Authorization Bypass in Repository CreationEPSS 1.0%CVE-2026-17603HIGHNexus Repository 3 - HikariCP connectionInitSql Injection RCE via DataStore Configuration APIEPSS 0.9%CVE-2026-77124HIGHNexus Repository 3 - Script Execution Disable Setting Not EnforcedEPSS 0.7%CVE-2026-97666MEDIUMNexus Repository 3 - Unsafe Reflection in ExtDirect Repository EndpointEPSS 0.6%CVE-2026-14644HIGHNexus Repository 3 - Privilege EscalationEPSS 0.6%CVE-2026-17601HIGHNexus Repository 3 - Wildcard Privilege Update Self-Escalation to AdministratorEPSS 0.5%