CVE-2026-77124: falha de alta gravidade em Sonatype Nexus Repository 3
Nexus Repository 3 - Script Execution Disable Setting Not Enforced
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.5epss 0.7%
In affected versions of Nexus Repository 3, the script execution endpoint (POST /service/rest/v1/script/{name}/run) did not verify whether script execution had been administratively disabled. An account holding script-execution permission could continue to run previously-created scripts even after an administrator set nexus.scripts.allowCreation=false, undermining the expectation that this setting fully blocks script execution.
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
Sonatype · Nexus Repository 3CVEs relacionadas — Sonatype Nexus Repository 3
No mesmo produto, das mais perigosas para as menos.
CVE-2026-17594HIGHNexus Repository 3 - Authorization Bypass in Repository CreationEPSS 1.0%CVE-2026-17603HIGHNexus Repository 3 - HikariCP connectionInitSql Injection RCE via DataStore Configuration APIEPSS 0.9%CVE-2026-97666MEDIUMNexus Repository 3 - Unsafe Reflection in ExtDirect Repository EndpointEPSS 0.6%CVE-2026-14644HIGHNexus Repository 3 - Privilege EscalationEPSS 0.6%CVE-2026-17601HIGHNexus Repository 3 - Wildcard Privilege Update Self-Escalation to AdministratorEPSS 0.5%CVE-2026-17599MEDIUMNexus Repository 3 - Unverified Onboarding State on change-admin-password EndpointEPSS 0.5%