CVE-2026-77124 is a high severity (7.2) flaw in Sonatype Nexus Repository 3. The script run endpoint ignored the setting that disables scripting, so an account with script permission could still run existing scripts. Sonatype's 3.96.0 release notes describe consistent enforcement of that setting. Confirm the fixed version with Sonatype.
What's affected
The record says affected versions of Nexus Repository 3 did not check whether scripting had been administratively disabled before the script run endpoint executed a script. The record gives no version range.
Sonatype's 3.96.0 to 3.96.4 release notes, which the record cites, have an item titled Consistent Scripting Controls. It says Nexus Repository now consistently enforces the nexus.scripts.allowCreation setting across all script operations, and that to run existing scripts you temporarily enable scripting in nexus.properties and restart. That strongly suggests 3.96.0 is where the behavior changed, but the release notes do not name this CVE, and Sonatype's support article for it sat behind a browser check we could not pass. Treat 3.96.0 as the likely fixed version and confirm it.
Where sources differ. The record gives no versions, and the release note describes the change without naming the CVE. We could not read Sonatype's support article. The record's 7.2 High is the only score we have, and the requirement for an account holding script-execution permission is part of that.
How to check if you're exposed
Look at two things. First, your version, shown in the Nexus Repository interface and in the support information your administrator can export. Second, your settings: in nexus.properties, check whether nexus.scripts.allowCreation is set to false.
The bug is that a false setting did not stop existing scripts from running. So the question that matters is who holds script-execution permission. List the roles and users with that privilege, and list the scripts that already exist through the script API.
If nobody should be running scripts, the permission should not exist on any account at all.
What to do now
- Confirm the fixed version with Sonatype, then upgrade Nexus Repository 3 to it. The release notes point to 3.96.0.
- Review roles and accounts that hold script-execution permission, and remove it where it is not needed.
- List existing scripts and delete any you do not recognize.
- Keep nexus.scripts.allowCreation set to false unless you have a current need, as the release notes advise.
- After the upgrade, test that scripts do not run while scripting is disabled.
Why it matters
The administrator's setting said scripting was off, but one endpoint never consulted it. That is an incorrect or incomplete protection mechanism, and the record files it under CWE-184, which covers incomplete lists of disallowed inputs, here a check that did not cover this endpoint. The result is that a control people trust did not hold.
Exploitation needs an account with script-execution permission, which is a high privilege, and the record's vector reflects that with high privileges required. It still matters, because Nexus scripting can run code on the repository server, and a repository manager sits in the middle of your build and release chain. The record does not mark it as a CISA KEV entry.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does setting allowCreation to false stop all scripts?
On affected versions, the record says no. Existing scripts could still run through the run endpoint by an account with script permission.
Which version fixes it?
The 3.96.0 release notes describe the consistent enforcement, but they do not name this CVE. Confirm with Sonatype.
Sources
Last reviewed: 18 October 2026.
