CVE-2026-17603: 
Sonatype Nexus 3 vulnerability analysis and mitigation

CVE-2026-17603 is a code injection vulnerability in Sonatype Nexus Repository 3 that allows an authenticated user with the nx-datastores-update permission to achieve remote code execution by abusing the DataStore configuration API. The vulnerability affects Nexus Repository 3 versions 3.20.0 through 3.94.x (fixed in 3.95.0), disclosed on August 7, 2026. It carries a CVSS v4.0 base score of 8.7 (High), assigned by Sonatype (GitHub Advisory, Sonatype Release Notes).

The root cause is insufficient restriction of HikariCP connection-pool properties exposed through the DataStore configuration API (CWE-94: Improper Control of Generation of Code). Specifically, the connectionInitSql property — intended to run SQL on each new database connection — was not blocked from being set via the API. An attacker with the nx-datastores-update permission can set this property to arbitrary SQL, which is then executed against the configured database on every new connection. On the default H2 embedded database backend, H2's INIT script feature supports executing Java code via RUNSCRIPT or similar mechanisms, enabling escalation from SQL injection to full OS-level code execution as the Nexus process user (GitHub Advisory, Sonatype Release Notes).

Successful exploitation grants an attacker arbitrary code execution as the operating system user running the Nexus Repository process, resulting in full compromise of confidentiality, integrity, and availability of the affected system. An attacker can read or exfiltrate all repository data (including credentials, artifacts, and configuration), modify or destroy repository contents, and use the compromised server as a pivot point for lateral movement within the network. The impact is most severe on default H2 database deployments, which are common in smaller or development environments (GitHub Advisory, Sonatype Release Notes).

As of the disclosure date (August 7, 2026), there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation. CISA's SSVC assessment classifies exploitation as "none" and the attack as non-automatable, reflecting the requirement for a privileged authenticated account. The EPSS score is approximately 0.387% (32nd percentile), indicating a relatively low near-term exploitation probability. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, Feedly).

1. Reconnaissance: Identify Nexus Repository 3 instances (versions 3.20.0–3.94.x) exposed on the network using tools like Shodan or Censys, or by browsing to the Nexus web UI and checking the version displayed in the footer.
2. Obtain credentials: Acquire credentials for an account with the nx-datastores-update permission — this may be through phishing, credential reuse, insider access, or compromise of an administrative account.
3. Access the DataStore configuration API: Authenticate to the Nexus REST API and send a PUT or POST request to the DataStore configuration endpoint (e.g., /service/rest/v1/datastores/{name}) to update the HikariCP connection pool properties.
4. Inject malicious connectionInitSql: Set the connectionInitSql property to a malicious SQL payload. On H2, this can leverage H2's built-in capabilities (e.g., CREATE ALIAS EXEC AS $$ ... $$; CALL EXEC('...')) to execute OS commands as the Nexus process user.
5. Trigger execution: The injected SQL executes automatically on every new database connection established by Nexus, which occurs during normal operation or can be triggered by performing any repository action that opens a new connection.
6. Achieve persistence or exfiltration: Use the code execution to establish a reverse shell, drop a web shell, exfiltrate repository data, or create a new administrative account for persistent access (GitHub Advisory, Sonatype Release Notes).

• Logs: Nexus audit log entries showing modification of DataStore configuration by a non-administrative or unexpected user account; database error logs containing unusual SQL execution traces or H2 INIT script activity.
• Network: Unexpected outbound connections from the Nexus server process to external IPs (indicative of reverse shell or data exfiltration); unusual API calls to /service/rest/v1/datastores/ endpoints from unfamiliar source IPs.
• Process: Unexpected child processes spawned by the Nexus Java process (e.g., sh, bash, cmd.exe, powershell, curl, wget); new listening ports opened by the Nexus process user.
• File System: New or modified files in the Nexus installation or data directories created by the Nexus process user outside of normal operation; presence of scripts, binaries, or web shells in Nexus directories.

Sonatype has addressed this vulnerability in Nexus Repository 3.95.0, released August 5, 2026. Organizations should upgrade to version 3.95.0 or later as the primary remediation (Sonatype Release Notes). As interim mitigations: restrict the nx-datastores-update permission to only highly trusted administrators; audit all accounts currently holding this permission and remove it where not strictly necessary; consider migrating from the default H2 database backend to PostgreSQL, which does not support OS-level code execution via SQL in the same manner; and monitor the DataStore configuration API for unauthorized changes.