Nexus by Sonatype is a repository manager that organizes, stores, and distributes artifacts needed for development. With Nexus, developers can completely control access to, and deployment of, every artifact in an organization from a single location, making it easier to distribute software.

Sonatype Nexus 3

Nexus by Sonatype is a repository manager that organizes, stores, and distributes artifacts needed for development. With Nexus, developers can completely control access to and deployment of every artifact in an organization from a single location, making it easier to distribute software.

Sonatype Nexus

A vulnerability in the task management component of Sonatype Nexus Repository versions 3.22.1 through 3.90.2 allows an authenticated attacker with task creation permissions to execute arbitrary code, bypassing the nexus.scripts.allowCreation security control.

CVE-2026-3199

CVE ID	Severity	Score	Technologies	Component name	CISA KEV exploit	Has fix	Published date
CVE-2026-3199	CRITICAL	9.4	Sonatype Nexus 3	cpe:2.3:a:sonatype:nexus_repository_manager	No	Yes	Apr 08, 2026
CVE-2026-5189	CRITICAL	9.2	Sonatype Nexus 3	cpe:2.3:a:sonatype:nexus_repository_manager_3	No	Yes	Apr 15, 2026
CVE-2026-3438	MEDIUM	5.1	Sonatype Nexus 3	cpe:2.3:a:sonatype:nexus_repository_manager	No	Yes	Apr 08, 2026
CVE-2026-0601	MEDIUM	5.1	Sonatype Nexus 3	cpe:2.3:a:sonatype:nexus_repository_manager	No	Yes	Jan 14, 2026
CVE-2025-13488	MEDIUM	5.1	Sonatype Nexus 3	cpe:2.3:a:sonatype:nexus_repository_manager	No	Yes	Dec 04, 2025

CVE-2026-3199:
Sonatype Nexus 3 vulnerability analysis and mitigation

9.4

Related Sonatype Nexus 3 vulnerabilities:

Benchmark your Cloud Security Posture

Additional Wiz resources

Cloud Vulnerability DB

Cloud Threat Landscape

PEACH

Ready to see Wiz in action?

CVE-2026-3199: Sonatype Nexus 3 vulnerability analysis and mitigation