CVE-2026-3199: Sonatype Nexus Repository RCE Vulnerability

CVE-2026-3199 Overview

A critical insecure deserialization vulnerability has been identified in the task management component of Sonatype Nexus Repository. This flaw affects versions 3.22.1 through 3.90.2 and allows an authenticated attacker with task creation permissions to execute arbitrary code on the target system. The vulnerability enables attackers to bypass the nexus.scripts.allowCreation security control, which is designed to prevent unauthorized script execution.

Critical Impact

Authenticated attackers with task creation permissions can achieve remote code execution by exploiting insecure deserialization in the task management component, potentially compromising the entire Nexus Repository infrastructure and downstream software supply chain.

Affected Products

• Sonatype Nexus Repository versions 3.22.1 through 3.90.2
• Nexus Repository Manager 3.x deployments with task creation permissions enabled
• Enterprise and OSS editions utilizing the task management component

Discovery Timeline

• 2026-04-08 - CVE-2026-3199 published to NVD
• 2026-04-08 - Last updated in NVD database

Technical Details for CVE-2026-3199

Vulnerability Analysis

This vulnerability is classified as CWE-502 (Deserialization of Untrusted Data). The flaw resides in the task management component of Sonatype Nexus Repository, which fails to properly validate serialized objects during task creation operations. An attacker with valid credentials and task creation permissions can craft malicious serialized payloads that are processed by the application without adequate security checks.

The vulnerability is particularly concerning because it bypasses the nexus.scripts.allowCreation security control—a mechanism specifically designed to prevent unauthorized script execution within the repository. This bypass effectively renders a key security boundary ineffective, allowing code execution even when administrators have explicitly disabled script creation capabilities.

Root Cause

The root cause of this vulnerability stems from insecure deserialization practices within the task management component. When processing task definitions, the application deserializes user-controlled data without implementing sufficient type checking or validation. This allows attackers to inject malicious objects that, when deserialized, trigger arbitrary code execution through gadget chains present in the application's classpath.

The nexus.scripts.allowCreation security control operates at a different layer than the deserialization mechanism, allowing the bypass to occur before the security check is evaluated.

Attack Vector

The attack is network-accessible and requires the attacker to have valid authentication credentials with task creation permissions. The exploitation flow involves:

1. The attacker authenticates to the Nexus Repository with an account possessing task creation privileges
2. A malicious serialized payload is crafted using available gadget chains
3. The payload is submitted through the task management interface
4. The vulnerable component deserializes the payload, triggering code execution
5. The attacker gains code execution context within the Nexus Repository application

The vulnerability manifests during task object deserialization within the management component. Attackers can exploit this by submitting specially crafted serialized Java objects that leverage existing library gadget chains to achieve code execution. For detailed technical information, refer to the Sonatype Support Article.

Detection Methods for CVE-2026-3199

Indicators of Compromise

• Unusual task creation events in Nexus Repository audit logs, particularly from unexpected user accounts
• Anomalous outbound network connections originating from the Nexus Repository process
• Unexpected child processes spawned by the Nexus Repository Java process
• Modifications to Nexus Repository configuration files or plugin directories

Detection Strategies

• Monitor Nexus Repository task creation API endpoints for suspicious payload patterns indicative of serialized Java objects
• Implement network-level monitoring for unusual egress traffic from Nexus Repository servers
• Deploy endpoint detection and response (EDR) solutions to identify post-exploitation activities such as process injection or lateral movement
• Review authentication logs for task creation activity from service accounts or users without legitimate business need

Monitoring Recommendations

• Enable comprehensive audit logging for all task management operations within Nexus Repository
• Configure SIEM alerts for task creation events outside normal business hours or from unexpected source IPs
• Implement file integrity monitoring on Nexus Repository installation directories
• Monitor Java process behavior for indicators of exploitation such as unexpected network connections or file system modifications

How to Mitigate CVE-2026-3199

Immediate Actions Required

• Upgrade Sonatype Nexus Repository to version 3.91.0 or later immediately
• Review and restrict task creation permissions to essential personnel only using the principle of least privilege
• Audit user accounts with task creation privileges and revoke access from any unnecessary accounts
• Implement network segmentation to limit exposure of Nexus Repository management interfaces

Patch Information

Sonatype has addressed this vulnerability in Nexus Repository version 3.91.0. Organizations should upgrade to this version or later as soon as possible. Detailed release information is available in the Sonatype Nexus Repository 3.91.0 Release Notes. Additional guidance can be found in the Sonatype Support Article.

Workarounds

• Restrict task creation permissions to only essential administrator accounts until patching can be completed
• Implement network access controls to limit which IP addresses can access Nexus Repository administrative interfaces
• Monitor and log all task creation activities for suspicious patterns while awaiting patch deployment
• Consider temporarily disabling the task management API if operationally feasible

# Example: Restrict network access to Nexus Repository admin interface
# Add to firewall rules to limit management interface access
iptables -A INPUT -p tcp --dport 8081 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 8081 -j DROP