PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-3329 Sonatype CVE debrief

CVE-2026-3329 is a HIGH severity vulnerability with a CVSS score of 8.7. A remote unauthenticated attacker may be able to conduct credential-guessing attacks against user accounts in Sonatype Nexus Repository via authentication endpoints. The CVE was published on 2026-06-11T18:16:25.343Z and last modified on 2026-06-11T21:02:42.240Z.

Vendor
Sonatype
Product
Nexus Repository Manager
CVSS
HIGH 8.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-11
Original CVE updated
2026-07-21
Advisory published
2026-06-11
Advisory updated
2026-07-21

Who should care

Users of Sonatype Nexus Repository should review and apply patches as recommended by the vendor.

Technical summary

The vulnerability affects Sonatype Nexus Repository and allows remote unauthenticated attackers to conduct credential-guessing attacks via authentication endpoints. The Common Vulnerability Scoring System (CVSS) score is 8.7, indicating a HIGH severity level.

Defensive priority

HIGH

Recommended defensive actions

  • Apply patches or updates provided by Sonatype as soon as possible.
  • Review authentication endpoints and ensure proper security measures are in place.
  • Monitor user accounts for suspicious activity.

Evidence notes

The vendor is listed as Unknown Vendor, but evidence suggests the product is Sonatype Nexus Repository.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-3329 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-3329

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-3329 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-3329

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://help.sonatype.com/en/sonatype-nexus-repository-3-93-0-release-notes.html

    103e4ec9-0a87-450b-af77-479448ddef11

  • Source reference

    Unverified legacy reference

    URL: https://support.sonatype.com/hc/en-us/articles/52482870409491

    103e4ec9-0a87-450b-af77-479448ddef11

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.