CVE-2026-3199: 
Sonatype Nexus 3 vulnerability analysis and mitigation

CVE-2026-3199 is an authenticated remote code execution (RCE) vulnerability in the task management component of Sonatype Nexus Repository Manager. It affects versions 3.22.1 through 3.90.x (Community and Pro editions) and allows an authenticated attacker with task creation permissions to execute arbitrary code by bypassing the nexus.scripts.allowCreation security control. The vulnerability was disclosed on April 8, 2026, and fixed in version 3.91.0. It carries a CVSS v4.0 base score of 9.4 (Critical) (GitHub Advisory, Sonatype Advisory).

The root cause is unsafe deserialization of untrusted data (CWE-502) within the task management component, mapped to CAPEC-586 (Object Injection). An attacker exploits this by crafting a malicious task that, when processed by the Nexus Repository task scheduler, triggers deserialization of attacker-controlled data and bypasses the nexus.scripts.allowCreation administrative control intended to prevent script-based code execution. The attack requires network access and low-level authenticated privileges (task creation permission), but no user interaction or special attack conditions. The vulnerability was discovered and responsibly reported by Wes Clemons of Millennium Corporation via Sonatype's Bug Bounty Program (Sonatype Advisory, GitHub Advisory).

Successful exploitation results in full compromise of the Nexus Repository server and its contents, including high impact to confidentiality, integrity, and availability of both the vulnerable system and subsequent systems. An attacker can gain unauthorized access to sensitive repository data (e.g., proprietary artifacts, credentials stored in the repository), modify or delete repository contents, and potentially pivot to other systems in the environment via lateral movement. The broad scope of impact — spanning both the primary Nexus instance and connected downstream systems — makes this a critical risk for organizations relying on Nexus Repository as a central artifact management platform (Sonatype Advisory, GitHub Advisory).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (GitHub Advisory). The EPSS score is approximately 0.073–0.088%, placing it in the lower percentile for near-term exploitation probability. No threat actor attribution has been reported, and the vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, Sonatype has cautioned that public disclosure may enable malicious actors to develop exploits targeting unpatched systems, and organizations should assess whether accounts with task creation permissions may have been misused prior to patching (Sonatype Advisory).

1. Reconnaissance: Identify internet-facing or internally accessible Sonatype Nexus Repository instances running versions 3.22.1 through 3.90.x using network scanning tools (e.g., Shodan, Censys, or internal asset inventories).
2. Obtain credentials: Acquire valid credentials for an account with task creation/management permissions. This may be achieved via phishing, credential stuffing, or by using a low-privilege account that has been delegated task management rights.
3. Authenticate to Nexus: Log in to the Nexus Repository web interface or REST API using the obtained credentials.
4. Craft malicious task: Create a specially crafted task payload that exploits the unsafe deserialization vulnerability in the task management component, embedding a serialized object designed to execute arbitrary code upon deserialization.
5. Submit and trigger task: Submit the malicious task via the Nexus task management interface or API endpoint. When the task scheduler processes the task, the deserialization of the attacker-controlled payload triggers arbitrary code execution on the server, bypassing the nexus.scripts.allowCreation control.
6. Achieve full compromise: Use the resulting code execution to establish persistence, exfiltrate repository contents, harvest credentials, or pivot to other systems in the environment (Sonatype Advisory, GitHub Advisory).

• Logs: Nexus audit logs showing unexpected task creation events, especially from accounts not typically associated with administrative task management; unusual task types or task names in the Nexus task scheduler logs; Java deserialization-related exceptions or stack traces in Nexus application logs.
• Network: Unexpected outbound connections from the Nexus Repository server to external IPs (potential reverse shell or C2 traffic); unusual API calls to the Tasks REST API (/service/rest/v1/tasks) from non-administrative accounts.
• Process: Unusual child processes spawned by the Nexus Repository Java process (e.g., bash, sh, cmd.exe, curl, wget, powershell); unexpected process execution under the Nexus service account.
• File System: New or modified files in the Nexus installation or work directories not associated with normal operations; presence of web shells, scripts, or binaries dropped by the Nexus service account.
• Authentication: Multiple failed login attempts followed by successful authentication from unfamiliar IP addresses; use of accounts with task creation permissions outside of normal business hours (Sonatype Advisory).

Sonatype has released a fix in Nexus Repository CE/Pro version 3.91.0 (released April 7, 2026); all users running versions 3.22.1 through 3.90.x should upgrade immediately. No configuration-based workaround is provided, but as an interim measure, organizations should restrict task creation permissions to only trusted administrators, audit existing accounts with task management privileges, and review Nexus audit logs for suspicious task creation activity. Additionally, implementing network segmentation to limit access to Nexus Repository instances to authorized users only can reduce the attack surface (Sonatype Advisory, Sonatype Release Notes).

Sonatype issued a formal security advisory on April 8, 2026, strongly encouraging immediate upgrades and noting that public disclosure could enable exploit development by malicious actors (Sonatype Advisory). The vulnerability was also noted in a Sonatype blog post highlighting risks associated with outdated repository versions (Sonatype Blog). Community discussion was observed on Mastodon (infosec.exchange) and CVE tracking platforms shortly after disclosure, reflecting moderate security community interest given the critical severity rating.