CVE-2026-17593 is a High severity flaw in Sonatype Nexus Repository 3 and legacy Nexus Repository 2. An account with the settings update permission could store arbitrary realm identifiers that were never validated, which could run unintended code in the Nexus process or lock out logins. It scores 7.2. The exact fixed version should be confirmed in Sonatype's advisory.
What's affected
Sonatype Nexus Repository 3 is named in the record. The record also names the legacy Nexus Repository 2, through the equivalent nexus:settings permission.
The fixed version is not stated in the NVD record. The record points to the Sonatype Nexus Repository 3.95.0 release notes and to a Sonatype support article. We could read the release notes: they list 3.95.0 on 5 August 2026 and 3.95.1 to 3.95.4 after it, but they do not name this CVE. The support article returned an access error when we fetched it. So we cannot confirm the exact fixed version here. Check the Sonatype support article for this CVE and upgrade to the version it names or a newer release.
The record scores it 7.2 (High) with vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.
How to check if you're exposed
Find the version you run, then compare it with the fixed version in the Sonatype article. The web interface shows the version in the About entry of the Help menu. If you run Nexus in a container, check the image tag you deployed.
docker ps
That lists running containers with their image names and tags, which is a quick way to spot old Nexus tags. Because the record does not state a fixed version, do not assume that any 3.x release is safe; use the Sonatype article. Then list who holds the nexus:settings:update permission in Nexus 3, or nexus:settings in Nexus 2. Exposure requires such an account, so a short list is good news.
What to do now
- Find your Nexus Repository version and compare it with the fixed version in Sonatype's advisory for this CVE.
- Upgrade to the fixed release, or a newer one, following Sonatype's upgrade guidance for your deployment type.
- Review accounts and roles holding
nexus:settings:update(Nexus 3) ornexus:settings(Nexus 2). Remove the permission where it is not needed. - Open the realm configuration and compare it with the realms you expect. The record says unrecognised entries could persist and that some effects were not visible in the administrative UI, so an unexpected login failure is also a clue.
- Back up the configuration before changing anything, so you can restore a known state.
Why it matters
The record classes the weakness as CWE-470, Use of Externally-Controlled Input to Select Classes or Code (unsafe reflection). The issue is that an internal configuration API accepted realm identifiers without checking them against the realms that are actually registered. The record classes this as CWE-470, use of externally controlled input to select classes or code. Realm identifiers name components that Nexus loads. Because unrecognised values were saved and evaluated on every realm load through a legacy code path, a bad value could cause unintended code to run inside the Nexus process.
In some cases it could also produce a persistent authentication lockout that the administrative UI did not show. That is an unusual failure mode: the symptom is that people cannot log in, and the interface gives no explanation.
The vector shows high privileges required, which is why the score is 7.2 and not higher. A repository manager is still a high-value target in a build pipeline, because it holds the artifacts your builds trust. Treat permission to change settings as close to administrator. The record does not report exploitation, and CISA does not list the CVE.
Try it yourself
When the advisory does not name a fixed version, the work is finding out what is available. This demo shows how a fix-available view helps you separate issues you can resolve today from ones that still need a vendor answer.
Click through it at your own pace, or open it full screen.
Quick check
Do I need administrator rights to exploit this?
The record says the account needs the settings update permission, which the vector scores as high privileges. It is not an anonymous attack.
Is the fixed version confirmed?
Not by the pages we could read. The record points to the 3.95.0 release notes, which do not name the CVE. Confirm in Sonatype's support article.
Sources
- Sonatype Nexus Repository 3.95.0 to 3.95.4 release notes, fetched 18 October 2026
- Sonatype support article for CVE-2026-17593, listed in the record but could not be read when fetched
Last reviewed: 18 October 2026.
