CVE-2026-3199 PUBLISHED

Nexus Repository 3 - Authenticated Remote Code Execution via Task Property Injection

Assigner: Sonatype
Reserved: 25.02.2026 Published: 08.04.2026 Updated: 08.04.2026

A vulnerability in the task management component of Sonatype Nexus Repository versions 3.22.1 through 3.90.2 allows an authenticated attacker with task creation permissions to execute arbitrary code, bypassing the nexus.scripts.allowCreation security control.

Metrics

CVSS 4.0

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L
CVSS Score: 9.4

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Network	Confidentiality	High	Confidentiality	High
Attack Complexity	Low	Integrity	High	Integrity	High
Attack Requirements	None	Availability	High	Availability	Low
Privileges Required	Low
User Interaction	None

CVSS 4.0

Product Status

Vendor	Sonatype
Product	Nexus Repository
Versions	Default: unaffected affected from 3.22.1 to 3.91.0 (excl.)

CVE-2026-3199 PUBLISHED

Nexus Repository 3 - Authenticated Remote Code Execution via Task Property Injection

Metrics

Product Status

Credits

References

Problem Types