CVE-2026-17593: Nexus Repository RCE Vulnerability

CVE-2026-17593 Overview

CVE-2026-17593 is an unsafe reflection vulnerability [CWE-470] affecting Sonatype Nexus Repository. An authenticated account holding the nexus:settings:update permission in Nexus Repository 3, or the equivalent nexus:settings permission in the legacy Nexus Repository 2, can submit arbitrary values as realm identifiers through an internal configuration API. The API fails to validate submitted identifiers against the set of registered realms. Unrecognized entries are persisted and re-evaluated on every realm load through a legacy code path. This behavior can result in unintended code executing inside the Nexus Repository process and, in some cases, a persistent authentication lockout that is not visible through the administrative user interface.

Critical Impact
Authenticated attackers with settings-update privileges can achieve code execution inside the Nexus Repository process and cause a persistent authentication lockout invisible to administrators.

Affected Products

Sonatype Nexus Repository 3 (versions prior to 3.95.0)
Sonatype Nexus Repository 2 (legacy line with the nexus:settings permission)
Deployments exposing the internal configuration API to privileged accounts

Discovery Timeline

2026-08-07 - CVE-2026-17593 published to the National Vulnerability Database
2026-08-08 - Last updated in NVD database

Technical Details for CVE-2026-17593

Vulnerability Analysis

The flaw resides in an internal configuration API used to manage authentication realms. Nexus Repository accepts realm identifiers submitted by callers with the nexus:settings:update permission and persists them to configuration storage. The persistence layer does not cross-check submitted identifiers against the registry of known realm implementations. On subsequent realm loads, a legacy code path reads the stored identifiers and attempts to instantiate the corresponding classes reflectively.

This pattern maps to unsafe reflection [CWE-470]. When attacker-controlled strings drive class resolution or instantiation, the process can be induced to load classes that were never intended to participate in authentication. The result is arbitrary code executing inside the Nexus Repository Java Virtual Machine (JVM) with the privileges of the service account.

A second impact is durable denial of service on the authentication surface. Because unrecognized realm identifiers remain persisted and are re-evaluated on every realm load, a poisoned configuration can prevent authentication from completing. The administrative UI does not surface the invalid entries, which complicates diagnosis and recovery.

Root Cause

The root cause is missing server-side validation of realm identifiers at the internal configuration API boundary. Any string a privileged caller supplies is accepted, stored, and later handed to a reflective loader. Trust is placed in the caller's role rather than in an allowlist of registered realm identifiers.

Attack Vector

Exploitation requires network access to the Nexus Repository management interface and an authenticated account with the nexus:settings:update or nexus:settings permission. An attacker with a compromised administrator or automation credential submits a crafted realm identifier through the internal configuration API. On the next realm load, whether triggered by service restart, configuration reload, or authentication activity, the injected identifier is resolved and executed. See the Sonatype Nexus Repository 3.95.0 Release Notes and the Sonatype Support Article for vendor guidance.

Detection Methods for CVE-2026-17593

Indicators of Compromise

Unexpected entries in the Nexus Repository authentication realm configuration that do not match registered realm identifiers.
Nexus Repository log entries showing class loading failures, ClassNotFoundException, or reflection errors during realm initialization.
Authentication failures across all users following a configuration change, with no corresponding change visible in the administrative UI.
Child processes spawned by the Nexus Repository JVM that are inconsistent with normal repository operations.

Detection Strategies

Audit the persisted realm configuration file and compare active realm identifiers against the vendor's list of registered realms.
Correlate nexus:settings:update API calls with subsequent restarts, realm reloads, or authentication anomalies.
Monitor the Nexus Repository process for unexpected outbound network connections, file writes outside its working directories, or spawned shell processes.

Monitoring Recommendations

Forward Nexus Repository application and audit logs to a centralized analytics platform and alert on realm configuration mutations.
Track all use of accounts holding the nexus:settings:update or nexus:settings permission and treat non-interactive changes as high priority.
Baseline the Nexus Repository JVM process tree and alert on deviations that indicate reflective code loading or command execution.

How to Mitigate CVE-2026-17593

Immediate Actions Required

Upgrade Nexus Repository 3 to version 3.95.0 or later, as documented in the vendor release notes.
Rotate credentials for any account holding nexus:settings:update or nexus:settings and audit recent use of those accounts.
Restrict network exposure of the Nexus Repository management interface to trusted administrative networks only.
Review the persisted realm configuration and remove any identifier that is not a registered realm shipped with the product.

Patch Information

Sonatype addressed the issue in Nexus Repository 3.95.0. Consult the Sonatype Nexus Repository 3.95.0 Release Notes for upgrade instructions and the Sonatype Support Article for remediation guidance covering the legacy Nexus Repository 2 code path.

Workarounds

Limit the nexus:settings:update and nexus:settings permissions to a minimum number of dedicated administrative accounts.
Enforce multi-factor authentication on all accounts capable of modifying Nexus Repository settings.
Place the Nexus Repository administrative endpoints behind a reverse proxy or firewall that restricts access by source IP.
Snapshot and back up the realm configuration so that a poisoned entry can be rolled back without a full reinstall.

bash

# Configuration example: restrict management API to an administrative CIDR
# (illustrative reverse-proxy rule, adapt to your environment)
location /service/rest/ {
    allow 10.10.0.0/24;   # administrative subnet
    deny  all;
    proxy_pass http://nexus_backend;
}