CVE-2026-17600 is a High severity flaw in Sonatype Nexus Repository 3. When a user's account was deleted, deactivated or had its password changed, an already logged-in session was not ended and cached permissions stayed. The old session could keep working until it expired. It scores 8.8. Check Sonatype's advisory for the fixed version.
What's affected
Sonatype Nexus Repository 3 is named in the record. It applies when an account is removed, disabled or has its password changed while its holder is signed in.
The fixed version is not stated in the NVD record. The record points to the Sonatype Nexus Repository 3.95.0 release notes and to a Sonatype support article. We could read the release notes: they list 3.95.0 on 5 August 2026 and 3.95.1 to 3.95.4 after it, but they do not name this CVE. The support article returned an access error when we fetched it. So we cannot confirm the exact fixed version here. Check the Sonatype support article for this CVE and upgrade to the version it names or a newer release.
The record scores it 8.8 (High) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
How to check if you're exposed
Find the version you run, then compare it with the fixed version in the Sonatype article. The web interface shows the version in the About entry of the Help menu. If you run Nexus in a container, check the image tag you deployed.
docker ps
That lists running containers with their image names and tags, which is a quick way to spot old Nexus tags. Because the record does not state a fixed version, do not assume that any 3.x release is safe; use the Sonatype article. Exposure is not about a stranger. It is about people whose access you removed. If you recently offboarded someone, a session opened before that could still be alive.
What to do now
- Find your Nexus Repository 3 version and compare it with the fixed version in Sonatype's advisory.
- Upgrade to the fixed release or newer.
- Until then, do not treat deleting or disabling an account as an immediate cut-off. The record says the old session continued until it expired on its own.
- Check your configured session lifetime. A shorter lifetime narrows the gap, though the advisory does not offer this as a fix.
- For urgent removals, ask Sonatype support how to end active sessions, and review repository changes made by that account since the removal.
Why it matters
The record classes the weakness as CWE-613, Insufficient Session Expiration. This is a session management flaw. The record classes it as CWE-613, insufficient session expiration. Logging in creates a session and a cache of the user's permissions. Removing the account, disabling it or changing its password should invalidate both. Here it did not, so the session carried on as if the account were active.
Depending on what the account could do, the consequence is continued read, modify or delete access to repository content after access was supposed to be revoked. The vector scores network access, low privileges and high impact on all three properties, which is why the number is 8.8.
The scenarios that matter are the ordinary ones: a contractor whose access ends, an employee who leaves, a credential you reset because you think it leaked. In each case the reset or removal is the control you rely on. A gap between taking the action and the access really ending is the risk. After you upgrade, it is worth reviewing account removals from the weeks before the fix. The record does not report exploitation and CISA does not list the CVE.
Quick check
Does changing a leaked password stop an attacker who is already signed in?
According to the record, not immediately. The existing session could continue until it expired on its own.
Who is at risk?
Organisations that remove or disable accounts and expect access to end at once, especially for users with write or delete rights.
Sources
- Sonatype Nexus Repository 3.95.0 to 3.95.4 release notes, fetched 18 October 2026
- Sonatype support article for CVE-2026-17600, listed in the record but could not be read when fetched
Last reviewed: 18 October 2026.
