[NEW] [medium] Sonatype Nexus Repository Manager: Multiple Vulnerabilities Enable Denial of Service
An attacker can exploit multiple vulnerabilities in Sonatype Nexus Repository Manager to conduct a denial of service attack, disclose information, execute code, or bypass security measures.
CSIRTS triage
- What
- Multiple vulnerabilities in Sonatype Nexus Repository Manager enable denial of service, information disclosure, code execution, and security bypass.
- Who is affected
- Organizations running Nexus Repository Manager are affected.
- Urgency
- Medium severity baseline, but code execution capability warrants urgent patching as repositories are critical infrastructure.
- Action
- Apply Sonatype security updates addressing CVE-2026-77121 through CVE-2026-77125.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch Nexus Repository Manager
Get an email when a new Nexus Repository Manager advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-3171
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-77121 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-77122 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-77123 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-77124 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-77125 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- unknownCVE-2026-77125: A vulnerability was identified in Sonatype Nexus Repository 3 in which two blobstore group man…nvd
- unknownCVE-2026-77124: In affected versions of Nexus Repository 3, the script execution endpoint (POST /service/rest/…nvd
- unknownCVE-2026-77123: Nexus Repository 3 contains a sensitive information disclosure vulnerability in the capability…nvd
- unknownCVE-2026-77122: An authorization flaw in the REST API repository details endpoint (GET /service/rest/v1/reposi…nvd
- unknownCVE-2026-77121: A user account with permission to deploy artifacts to a hosted Maven repository could upload a…nvd
Recent advisories for Sonatype Nexus Repository Manager
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- unknownCVE-2026-77125: A vulnerability was identified in Sonatype Nexus Repository 3 in which two blobstore group man…nvd · 2026-09-02
- high[NEW] [high] Sonatype Nexus Repository Manager: Multiple vulnerabilitiescert-bund · 2026-08-10
- medium[NEW] [medium] Sonatype Nexus Repository Manager: Multiple vulnerabilitiescert-bund · 2026-07-15
- unknownCVE-2026-11403: A vulnerability in Sonatype Nexus Repository Manager's format-specific API key generation may …nvd · 2026-07-14
- criticalexploitedCVE-2019-7238: Sonatype Nexus Repository Manager Incorrect Access Control Vulnerabilitycisa-kev · 2021-12-10
More from CERT-Bund (BSI) Security Advisories
- high[NEW] [high] BigBlueButton: Multiple Vulnerabilities2026-09-03
- high[NEW] [high] IBM i: Multiple Vulnerabilities2026-09-03
- medium[NEW] [medium] Red Hat Enterprise Linux (libsolv, aardvark-dns): Multiple vulnerabilities2026-09-03
- medium[UPDATE] [medium] Linux Kernel: Multiple vulnerabilities2026-09-03
- low[UPDATE] [low] vim: Vulnerability allows file manipulation2026-09-03