CVE-2026-14644
High
Description
Nexus Repository 3 contained a privilege escalation vulnerability in the REST privileges API. An authenticated user with permission to manage privileges could, under certain role configurations, escalate their own access to full administrator by exploiting a type-confusion flaw in the privilege update endpoint.
SeverityHigh
CVSS7.2
Exploit probability—
ProductSonatype Nexus Repository Manager
PublishedAug 7, 2026
First seenAug 7, 2026
Weakness typeCWE-843CWE-843
How to fix
Update
- sonatype nexus_repository_manager3.95.0 or later
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| sonatype nexus_repository_manager | 3.19.0 ≤ v < 3.95.0 | 3.95.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.