CVE-2026-3199CWE-502insecure-deserialization

CVE-2026-3199

High · published April 9, 2026

CVSS v3.1
8.8
EPSS
1%
Percentile
55.1
In the wild
Unconfirmed
What it is

A vulnerability in the task management component of Sonatype Nexus Repository versions 3.22.1 through 3.90.2 allows an authenticated attacker with task creation permissions to execute arbitrary code, bypassing the nexus.scripts.allowCreation security control.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00769 · 55.1th percentile
Weakness
CWE-502 · Deserialization of Untrusted Data
Published
2026-04-09T03:16Z
Affected products (1)
ProductVersionsFixed in
sonatype/nexus_repository_manager≥ 3.22.1, < 3.91.03.91.0
References (2)
https://help.sonatype.com/en/sonatype-nexus-repository-3-91-0-release-notes.html · 103e4ec9-0a87-450b-af77-479448ddef11https://support.sonatype.com/hc/en-us/articles/50615414548499 · 103e4ec9-0a87-450b-af77-479448ddef11
EPSS history
Timeline
  • 08 APR 22:17Z
    Nexus Repository 3 - Authenticated Remote Code Execution via Task Property Injection
    cvelistv5