CVE-2026-3329
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk40th percentile - higher than 40% of all known CVEs
Summary
A vulnerability in Sonatype Nexus Repository allows a remote unauthenticated attacker to perform credential-guessing attacks against user accounts via authentication endpoints.
Risk Assessment
The risk involves potential account takeover through brute-force or dictionary attacks, leading to unauthorized access to repositories and managed artifacts.
Recommendation
It is recommended to immediately update Sonatype Nexus Repository to the latest patched version and implement login rate-limiting mechanisms such as account lockout after multiple failed attempts.
Other vulnerabilities in Sonatype Nexus Repository
See all- CVE-2026-3199Critical
A vulnerability in the task management component of Sonatype Nexus Repository versions 3.22.1 through 3.90.2 allows an authenticated attacker with task creation permissions to execute arbitrary code, bypassing the nexus.scripts.allowCreation security control.
- CVE-2026-10748High
An authenticated user with the nx-licensing-create privilege can upload a specially crafted license file to execute arbitrary operating system commands as the Nexus process user in Sonatype Nexus Repository 3 versions before 3.92.0.
- CVE-2026-3438Medium
Sonatype Nexus Repository versions 3.0.0 through 3.90.2 contain a reflected cross-site scripting vulnerability that allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser through a specially crafted URL. Exploitation requires user interaction.
Original NVD description (English source)
A remote unauthenticated attacker may be able to conduct credential-guessing attacks against user accounts in Sonatype Nexus Repository via authentication endpoints.