Vulnerability · Published Sep 2, 2026 · Assigned by Sonatype

CVE-2026-77124Nexus Repository 3 - Script Execution Disable Setting Not Enforced

High 7.5

In plain English

A high-severity security flaw in Nexus Repository 3 from Sonatype. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities).

Severity (CVSS 4.0)7.5High

Exploit odds (30 days)0.7%top 45.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

In affected versions of Nexus Repository 3, the script execution endpoint (POST /service/rest/v1/script/{name}/run) did not verify whether script execution had been administratively disabled. An account holding script-execution permission could continue to run previously-created scripts even after an administrator set nexus.scripts.allowCreation=false, undermining the expectation that this setting fully blocks script execution.

Affected products (as reported)

Vendor	Product	Versions
Sonatype	Nexus Repository 3	3.21.2 – before 3.96.0

Weakness: CWE-184 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

In plain English

Official description

Affected products (as reported)

References