CVE-2026-17599 is a High severity flaw in Sonatype Nexus Repository 3. An onboarding endpoint did not check that initial setup was still in progress, so an account holding the all-permissions grant could replace the administrator password later, and existing sessions stayed valid. It scores 7.2. Confirm the fixed version in Sonatype's advisory.
What's affected
Sonatype Nexus Repository 3 is named in the record. The affected endpoint is the one used to set the administrator password during initial onboarding.
The fixed version is not stated in the NVD record. The record points to the Sonatype Nexus Repository 3.95.0 release notes and to a Sonatype support article. We could read the release notes: they list 3.95.0 on 5 August 2026 and 3.95.1 to 3.95.4 after it, but they do not name this CVE. The support article returned an access error when we fetched it. So we cannot confirm the exact fixed version here. Check the Sonatype support article for this CVE and upgrade to the version it names or a newer release.
The record scores it 7.2 (High) with vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.
How to check if you're exposed
Find the version you run, then compare it with the fixed version in the Sonatype article. The web interface shows the version in the About entry of the Help menu. If you run Nexus in a container, check the image tag you deployed.
docker ps
That lists running containers with their image names and tags, which is a quick way to spot old Nexus tags. Because the record does not state a fixed version, do not assume that any 3.x release is safe; use the Sonatype article. Then count the accounts that hold nexus:*. The attack needs it, so any account with that permission is where to look first.
What to do now
- Find your Nexus Repository 3 version and compare it with the fixed version in Sonatype's advisory.
- Upgrade to the fixed release or newer.
- List every account and role that carries
nexus:*. That permission is effectively administrator, so keep the list short. - If you suspect misuse, reset the administrator password through your normal process and check recent administrator activity, including logins you do not recognise.
- Keep in mind that, according to the record, sessions were not invalidated after the password change, so restarting the service or expiring sessions is part of cleanup.
Why it matters
The record classes the weakness as CWE-620, Unverified Password Change. The endpoint exists for a good reason: when someone first installs Nexus, they must set an administrator password. The mistake was in how the code decided that onboarding was still happening. Instead of checking the state of the system, it relied on a local onboarding artifact being present. The record classes the weakness as CWE-620, unverified password change.
With the wrong check, an account holding the all-permissions grant could call the endpoint after setup and replace the administrator password. The record adds that existing sessions were not invalidated after the change. That is a second problem: if the old password was compromised, the attacker keeps their session while the legitimate owner is locked out or unaware.
The vector shows network access with high privileges. So this is about privilege abuse and persistence, not a stranger breaking in. In a repository manager shared by several teams, a person with broad permissions can turn them into the one administrator account that controls everything, quietly. Fix the version and keep broad permissions rare. The record does not report exploitation and the CVE is not in the CISA catalog.
Quick check
Can an unauthenticated person reset the admin password with this?
No. The record says the caller must hold the nexus:* permission.
What should I do about open sessions?
The record says sessions were not invalidated after the password change. After upgrading, expire or restart sessions as part of cleanup.
Sources
- Sonatype Nexus Repository 3.95.0 to 3.95.4 release notes, fetched 18 October 2026
- Sonatype support article for CVE-2026-17599, listed in the record but could not be read when fetched
Last reviewed: 18 October 2026.
