CVE-2026-14644 is a high severity privilege escalation flaw (CVSS 7.2) in Sonatype Nexus Repository 3. An authenticated user who can manage privileges could, under certain role configurations, escalate to full administrator through the privilege update endpoint. Check Sonatype's advisory for the fixed version.
What's affected
- Sonatype Nexus Repository 3, per the CVE record. The record does not list version numbers.
- Fixed: I could not confirm the fixed version. The record references the Nexus Repository 3.95.0 release notes and a Sonatype support article. I read the release notes but did not find this CVE in the portion I could access, and the support article returned an access error. Check both before choosing a target version.
- The attacker needs an account that can manage privileges, and certain role configurations.
Severity: the record scores this 7.2 High (vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). I could not read a vendor score.
How to check if you're exposed
Find your Nexus Repository version in the administration settings under support, or in the application's status page. Then review who holds privilege management rights.
Use the support view in the UI for the version. Then export the list of roles that include privilege management and review them.
What to do now
- Record the Nexus Repository 3 version.
- Read Sonatype's referenced advisory and the 3.95.0 release notes to find the fixed build, and upgrade.
- List roles and users with permission to manage privileges, and trim them.
- Review audit logs for privilege changes made to the administrator role.
Why it matters
The record classes this as CWE-843 (Access of Resource Using Incompatible Type), also known as type confusion. The privilege update endpoint handles a value as one type when it is another, and under certain role configurations that lets a user raise their own access to full administrator.
The attacker already holds a powerful permission, which is why this is rated High rather than Critical. But artifact repositories are central to the software supply chain. An administrator can alter stored packages and proxy settings, so the flaw is worth fixing even though the starting access is privileged. The record does not list the CVE as exploited, and it is not in the CISA KEV catalog.
Repository managers are part of the software supply chain, so treat their administrator role like a production deploy key. Keep the number of administrators small, require strong authentication for them, and watch for changes to roles and privileges as a standing alert.
Quick check
Why is the fixed version not stated?
I could not confirm it from the pages I could read. Check Sonatype's advisory.
Does a low privilege user qualify?
No. The record says the user needs permission to manage privileges.
Sources
Last reviewed: 18 October 2026.
