PT-2026-31544 · Sonatype · Sonatype Nexus Repository

Wes Clemons · CVE-2026-3199 · Published 2026-04-08 · Updated 2026-06-11

Positive Technologies (AI Summary)

CVSS v4.0

9.4

Critical

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Sonatype Nexus Repository versions 3.22.1 through 3.90.2

Description A flaw in the task management component allows an authenticated attacker with task creation permissions to execute arbitrary code. This is achieved through task property injection, which bypasses the nexus.scripts.allowCreation security control.

Recommendations Update to a version later than 3.90.2. As a temporary mitigation, restrict task creation permissions to trusted users only.

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2026-3199

Affected Products

Sonatype Nexus Repository

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-3199 · Security Note
• https://support.sonatype.com/hc/en-us/articles/50615414548499 · Vendor Advisory
• https://help.sonatype.com/en/sonatype-nexus-repository-3-91-0-release-notes.html · Patch
• https://twitter.com/jdelta11/status/2065105016558395601 · Twitter Post
• https://twitter.com/infoflowcloud/status/2042013002413613242 · Twitter Post
• https://twitter.com/ArmadinSecurity/status/2065068477803553142 · Twitter Post
• https://twitter.com/CVEnew/status/2042010555880260093 · Twitter Post
• https://twitter.com/0dayPublishing/status/2042005701355036878 · Twitter Post