CVE-2026-17600: 
Sonatype Nexus 3 vulnerability analysis and mitigation

CVE-2026-17600 is an Insufficient Session Expiration vulnerability in Sonatype Nexus Repository 3 that allows authenticated users whose accounts have been deleted, deactivated, or had their passwords changed to continue accessing the repository using their existing active session until it naturally expires. The vulnerability affects Nexus Repository 3 versions 3.0.0 through 3.94.x (prior to 3.95.0), as well as the underlying Maven artifacts org.sonatype.security:security-system (1.1.0–3.3) and org.sonatype.nexus:nexus-security (2.6.0-01–3.88.0-08). It was published on August 7, 2026, with a fix released in version 3.95.0. The vulnerability carries a CVSS v4.0 base score of 8.7 (High) (Github Advisory, Sonatype Release Notes).

The root cause is classified as CWE-613 (Insufficient Session Expiration): when an administrator deletes, deactivates, or changes the password of a user account, Nexus Repository 3 does not immediately invalidate that user's active session token or flush their cached permission set. The session remains valid and the cached permissions continue to be honored until the session independently times out, effectively bypassing the intended access revocation. Exploitation requires only that the attacker already hold a valid, active session at the time the administrative action is taken — no additional privileges or user interaction are needed beyond the initial authenticated state (Github Advisory).

A user whose account has been revoked can continue to read, modify, or delete repository content — including hosted packages, proxied artifacts, and configuration data — for the duration of their existing session. Depending on the permissions previously held, this could include uploading malicious packages into internal repositories, deleting critical artifacts, or exfiltrating proprietary software components. In environments where Nexus Repository serves as a central artifact store for CI/CD pipelines, unauthorized modification of repository content could propagate malicious artifacts downstream into build and deployment processes (Github Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure (Github Advisory). The EPSS score is approximately 0.215% (12th percentile), indicating a low near-term probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is not automatable, as it requires an attacker to already possess an active authenticated session at the precise moment an administrative revocation action occurs.

1. Obtain an active session: The attacker authenticates to the Nexus Repository 3 instance using valid credentials, obtaining a session token (e.g., via the web UI or REST API).
2. Maintain the session: The attacker keeps the session alive (e.g., by periodically making API calls or keeping a browser session open).
3. Wait for or trigger account revocation: An administrator deletes, deactivates, or changes the password of the attacker's account — either as a routine offboarding action or in response to a suspected compromise.
4. Continue unauthorized access: Because the session is not immediately invalidated, the attacker continues to use the existing session token to interact with the Nexus Repository API or UI, performing actions consistent with their previously held permissions (e.g., GET /service/rest/v1/components, POST /service/rest/v1/components, DELETE /service/rest/v1/components/{id}).
5. Achieve objective: The attacker reads sensitive artifacts, uploads tampered packages, or deletes repository content until the session naturally expires (Github Advisory).

• Logs: Nexus Repository access logs showing successful API or UI requests from a session associated with a user account that has been deleted or deactivated — look for authenticated requests occurring after the timestamp of the administrative revocation action.
• Logs: Audit log entries reflecting repository read, write, or delete operations attributed to a user account that no longer exists or is marked inactive in the user management interface.
• Network: REST API calls (e.g., to /service/rest/v1/components, /service/rest/v1/repositories) using session tokens or user tokens belonging to revoked accounts, originating from unexpected IP addresses.
• Application: Presence of session tokens in active use that correspond to accounts with a deleted or disabled status in the Nexus user store.

Upgrade to Sonatype Nexus Repository 3.95.0 or later, which addresses the session termination flaw (Sonatype Release Notes). As an interim workaround for environments that cannot immediately upgrade, administrators should implement short session timeout policies to minimize the window of unauthorized access, and manually monitor audit logs for activity from recently revoked accounts. Additionally, restarting the Nexus Repository service after revoking a user account will clear all active sessions, effectively forcing immediate session termination.