CVE-2026-10748CWE-502insecure-deserialization

CVE-2026-10748

High · published June 16, 2026

CVSS v3.1
7.2
EPSS
0%
Percentile
24.2
In the wild
Unconfirmed
What it is

An authenticated user with the nx-licensing-create privilege can upload a specially crafted license file to execute arbitrary operating system commands as the Nexus process user in Sonatype Nexus Repository 3 versions before 3.92.0.

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00324 · 24.2th percentile
Weakness
CWE-502 · Deserialization of Untrusted Data
Published
2026-06-16T23:16Z
Affected products (1)
ProductVersionsFixed in
sonatype/nexus_repository_manager≥ 3.0.0, < 3.92.03.92.0
References (2)
https://help.sonatype.com/en/sonatype-nexus-repository-3-92-0-release-notes.html · 103e4ec9-0a87-450b-af77-479448ddef11https://support.sonatype.com/hc/en-us/articles/52335766035603 · 103e4ec9-0a87-450b-af77-479448ddef11
EPSS history
Timeline
  • 16 JUN 17:42Z
    Nexus Repository 3 - Remote Code Execution via License Deserialization
    cvelistv5