CVE-2026-17599
High
Description
Nexus Repository 3 contained an endpoint used to change the administrator account password during initial onboarding. This endpoint did not verify that onboarding was still in progress before allowing the password change, relying instead on the presence of a local onboarding artifact. As a result, an account holding the nexus:* permission could invoke the endpoint outside the intended onboarding flow to replace the administrator password, and existing sessions were not invalidated after the change.
SeverityHigh
CVSS7.2
Exploit probability—
ProductSonatype Nexus Repository Manager
PublishedAug 7, 2026
First seenAug 7, 2026
Weakness typeCWE-620CWE-620
How to fix
Update
- sonatype nexus_repository_manager3.95.0 or later
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| sonatype nexus_repository_manager | 3.17.0 ≤ v < 3.95.0 | 3.95.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.