PT-2026-33132 · Sonatype · Nexus Repository Manager

Published 2026-04-15 · Updated 2026-04-16 · CVE-2026-5189

Positive Technologies (AI Summary)

CVSS v4.0

9.2

Critical

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Sonatype Nexus Repository Manager versions 3.0.0 through 3.70.5

Description Use of hard-coded credentials allows an unauthenticated attacker with network access to gain unauthorized read/write access to the internal database and execute arbitrary OS commands as the Nexus process user. This issue is exploitable when the non-default configuration nexus.orient.binaryListenerEnabled is set to true.

Recommendations Update to version 3.71.0. As a temporary workaround, ensure the nexus.orient.binaryListenerEnabled configuration is disabled.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2026-5189

Affected Products

Nexus Repository Manager

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-5189 · Security Note
• https://help.sonatype.com/en/sonatype-nexus-repository-3-71-0-release-notes.html · Patch
• https://support.sonatype.com/hc/en-us/articles/50817138825491 · Vendor Advisory
• https://twitter.com/the_yellow_fall/status/2044784879653494808 · Twitter Post
• https://twitter.com/CVEnew/status/2044737930321625294 · Twitter Post
• https://twitter.com/0dayPublishing/status/2044489618440008174 · Twitter Post
• https://twitter.com/vuln_tracker/status/2044682137765659001 · Twitter Post
• https://twitter.com/shreyas_chavhan/status/2044655017790144997 · Twitter Post