CVE-2026-10748 Sonatype CVE debrief

Who should care

Defenders responsible for Sonatype Nexus Repository 3 instances, particularly those with users holding the nx-licensing-create privilege, should assess exposure and potential impact.

Why it matters

CVE-2026-10748 is a high-severity vulnerability in Sonatype Nexus Repository 3, allowing authenticated users with specific privileges to execute arbitrary OS commands. Defenders should prioritize verifying exposure, assessing potential impact, and updating to version 3.92.0 or later.

• Potential for authenticated users to execute arbitrary OS commands
• Possible lateral movement or privilege escalation
• Risk of unauthorized access or data breaches
• Need for verification of user privileges and access controls

Technical summary

CVE-2026-10748 is a vulnerability in Sonatype Nexus Repository 3 versions before 3.92.0, allowing authenticated users with the nx-licensing-create privilege to execute arbitrary operating system commands by uploading a specially crafted license file.

Defensive priority

Defenders should prioritize verifying exposure and assessing potential impact, focusing on authenticated users with the nx-licensing-create privilege.

Recommended defensive actions

• Verify exposure by checking for authenticated users with the nx-licensing-create privilege
• Assess potential impact by evaluating the privileges of affected users
• Update to version 3.92.0 or later to remediate the vulnerability
• Monitor for suspicious activity related to license file uploads

Evidence notes

The CVE record and NVD detail page provide information on the vulnerability, including its description, CVSS score, and affected versions. The vulnerability affects Sonatype Nexus Repository 3 versions before 3.92.0. The nx-licensing-create privilege is required to exploit the vulnerability. The CVE record was published on 2026-06-16T19:16:30.607Z and has not been modified since then. The NVD entry is currently Analyzed. There are no known reports of exploitation. Defenders should to

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.