CVE-2026-5189
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
Sonatype Nexus Repository Manager versions 3.0.0 through 3.70.5 contain hard-coded credentials (CWE-798), allowing an unauthenticated attacker with network access to gain unauthorized read/write access to the internal database and execute arbitrary OS commands as the Nexus process user. Exploitation requires the non-default nexus.orient.binaryListenerEnabled=true configuration.
Risk Assessment
Risk of full compromise of the Nexus system, including data access and command execution, under certain configuration conditions.
Recommendation
Upgrade to a version newer than 3.70.5 and disable nexus.orient.binaryListenerEnabled if not required.
Other vulnerabilities in Sonatype Nexus Repository Manager
See all- CVE-2019-7238CriticalActively exploited
Sonatype Nexus Repository Manager before 3.15.0 has incorrect access control, which may allow unauthorized users to perform operations they are not permitted to do.
- CVE-2017-17717Critical
Sonatype Nexus Repository Manager through 2.14.5 has weak password encryption with a hardcoded CMMDwoV value in the LDAP integration feature.
- CVE-2026-11403High
A vulnerability in Sonatype Nexus Repository Manager allows a remote attacker to gain unauthorized access to repository operations as a targeted user. Exploitation requires enabling a format-specific API key realm (NuGet API Key, Docker Bearer Token, or npm Bearer Token) and the targeted user having an active API key.
- CVE-2026-10741Medium
Vulnerability in Sonatype Nexus Repository Manager before version 3.93.0 allows a delegated repository administrator to disclose stored upstream proxy credentials via an authorization flaw in proxy repository configuration.
Original NVD description (English source)
CWE-798: Use of Hard-coded Credentials in Sonatype Nexus Repository Manager versions 3.0.0 through 3.70.5 allows an unauthenticated attacker with network access to gain unauthorized read/write access to the internal database and execute arbitrary OS commands as the Nexus process user. Exploitation requires the non-default nexus.orient.binaryListenerEnabled=true configuration to be enabled.