CVE-2026-3199
CriticalCVSS 9.4Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
A vulnerability in the task management component of Sonatype Nexus Repository versions 3.22.1 through 3.90.2 allows an authenticated attacker with task creation permissions to execute arbitrary code, bypassing the nexus.scripts.allowCreation security control.
Risk Assessment
An attacker could take control of the Nexus repository, potentially leading to data theft or further attacks on infrastructure.
Recommendation
Update Sonatype Nexus Repository to version 3.91.0 or later, which includes the fix.
Original NVD description (English source)
A vulnerability in the task management component of Sonatype Nexus Repository versions 3.22.1 through 3.90.2 allows an authenticated attacker with task creation permissions to execute arbitrary code, bypassing the nexus.scripts.allowCreation security control.