PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-10748 Sonatype CVE debrief

CVE-2026-10748 is a high-severity vulnerability in Sonatype Nexus Repository 3, with a CVSS score of 8.6. An authenticated user with the nx-licensing-create privilege can upload a specially crafted license file to execute arbitrary operating system commands as the Nexus process user in versions before 3.92.0.

Vendor
Sonatype
Product
Nexus Repository
CVSS
HIGH 8.6
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-16
Original CVE updated
2026-06-17
Advisory published
2026-06-16
Advisory updated
2026-06-17

Who should care

Users of Sonatype Nexus Repository 3, especially those with nx-licensing-create privileges, should be aware of this vulnerability and take steps to mitigate it.

Technical summary

CVE-2026-10748 is a vulnerability in Sonatype Nexus Repository 3 that allows authenticated users with the nx-licensing-create privilege to execute arbitrary OS commands by uploading a specially crafted license file.

Defensive priority

High

Recommended defensive actions

  • Upgrade to Sonatype Nexus Repository 3 version 3.92.0 or later.
  • Restrict nx-licensing-create privileges to only necessary users.
  • Monitor for suspicious activity and implement additional security measures as needed.

Evidence notes

The CVE record and NVD detail provide information on the vulnerability, including its CVSS score and affected versions.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-10748 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-10748

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-10748 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-10748

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://help.sonatype.com/en/sonatype-nexus-repository-3-92-0-release-notes.html

    103e4ec9-0a87-450b-af77-479448ddef11

  • Source reference

    Unverified legacy reference

    URL: https://support.sonatype.com/hc/en-us/articles/52335766035603

    103e4ec9-0a87-450b-af77-479448ddef11

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.