CVE-2026-77124: 
Sonatype Nexus 3 vulnerability analysis and mitigation

CVE-2026-77124 is a security feature bypass vulnerability in Sonatype Nexus Repository 3 affecting the script execution REST API endpoint. The flaw allows authenticated users with script-execution permission to invoke previously-created scripts via POST /service/rest/v1/script/{name}/run even after an administrator has disabled script execution by setting nexus.scripts.allowCreation=false. Affected versions span from 3.21.2 up to (but not including) 3.96.0. It was published on September 2, 2026, and carries a CVSS v4.0 base score of 7.5 (High) (Github Advisory, Sonatype Release Notes).

The root cause is classified as CWE-184 (Incomplete List of Disallowed Inputs): the script execution endpoint failed to check the administrative nexus.scripts.allowCreation=false flag before permitting script runs, meaning the enforcement logic was incomplete. An attacker must already hold an account with the nx-script-*-run privilege (high privilege requirement), and previously-created scripts must exist on the instance (attack requirement: present). Exploitation is network-based and requires no user interaction — the attacker simply sends an authenticated HTTP POST to /service/rest/v1/script/{name}/run with a valid session token, bypassing the expected administrative control (Github Advisory).

Successful exploitation allows an authenticated attacker to execute arbitrary Groovy scripts on the Nexus Repository server, resulting in high confidentiality, integrity, and availability impact to the vulnerable system. This can lead to unauthorized access to stored artifacts and credentials, modification or deletion of repository data, and potential full server compromise. Because Nexus Repository often sits at the center of software supply chains, a compromised instance could be leveraged to inject malicious artifacts into downstream build pipelines, amplifying the blast radius significantly (Github Advisory).

As of the disclosure date, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Github Advisory). The NVD SSVC assessment confirms exploitation status as "none" and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.307% (23rd percentile), indicating a low near-term exploitation probability. Exploitation requires high privileges (script-execution permission) and pre-existing scripts on the target instance, which limits the attacker pool.

1. Reconnaissance: Identify Nexus Repository 3 instances running versions 3.21.2 through 3.95.x using network scanning tools (e.g., Shodan, Censys) or by probing the /service/rest/v1/status endpoint to confirm the product and version.
2. Credential Acquisition: Obtain valid credentials for an account with the nx-script-*-run privilege — this could be through credential theft, phishing, or abuse of a compromised service account.
3. Enumerate Existing Scripts: Authenticate and send a GET /service/rest/v1/script request to list all previously-created scripts available on the instance.
4. Trigger Script Execution: Despite nexus.scripts.allowCreation=false being set by the administrator, send an authenticated POST /service/rest/v1/script/{name}/run request targeting a known script name. The endpoint does not validate the administrative disable flag and will execute the script.
5. Achieve Objective: Leverage the executed Groovy script to perform actions such as exfiltrating credentials, reading sensitive configuration files, modifying repository content, or establishing persistence on the underlying server (Github Advisory).

• Network: Authenticated HTTP POST requests to /service/rest/v1/script/{name}/run originating from unexpected source IPs or at unusual times, particularly when script execution is expected to be administratively disabled.
• Logs: Nexus Repository audit logs (audit.log) showing script resource run actions by accounts that should not have active script execution rights; REST API access logs recording POST calls to the script run endpoint after nexus.scripts.allowCreation=false was configured.
• Process: Unexpected child processes spawned by the Nexus Repository JVM process (e.g., bash, curl, wget, python) that may indicate script-driven command execution on the host.
• File System: New or modified files in the Nexus Repository work directory or system directories created by the Nexus service account following script execution events.

Upgrade Sonatype Nexus Repository 3 to version 3.96.0 or later, which resolves the bypass by enforcing the nexus.scripts.allowCreation=false check at the script execution endpoint (Sonatype Release Notes, Github Advisory). As an interim workaround prior to patching, restrict or revoke script-execution privileges (nx-script-*-run) from all non-administrator accounts, and audit existing scripts to remove any that are unnecessary. Additionally, monitor the script execution API endpoint for unauthorized activity and consider network-level controls to limit access to the Nexus REST API to trusted hosts only.