CVE-2026-5189 Sonatype CVE debrief

Who should care

Defenders and administrators of Sonatype Nexus Repository Manager instances should assess exposure and apply remediation immediately. This includes operators responsible for maintaining the affected systems, platform administrators, vulnerability management teams, and security teams that need to verify the configuration and apply necessary patches or mitigations.

Why it matters

CVE-2026-5189 is a critical vulnerability in Sonatype Nexus Repository Manager that allows unauthorized access and arbitrary OS command execution. Defenders and administrators should assess exposure and apply remediation immediately.

• Potential unauthorized access to internal database
• Potential execution of arbitrary OS commands
• Need for immediate assessment and remediation
• Verification of non-default configuration

Technical summary

CVE-2026-5189 is a CWE-798 vulnerability in Sonatype Nexus Repository Manager versions 3.0.0 through 3.70.5. An unauthenticated attacker with network access can gain unauthorized read/write access to the internal database and execute arbitrary OS commands as the Nexus process user when the non-default configuration 'nexus.orient.binaryListenerEnabled=true' is enabled. This vulnerability allows potential unauthorized access to internal database and potential execution of arbitrary OS commands. The vulnerability has a CVSS score of 9.2 and a severity of CRITICAL.

Defensive priority

High priority for immediate assessment and remediation

Recommended defensive actions

• Immediately assess exposure of Nexus Repository Manager instances
• Verify if the non-default configuration 'nexus.orient.binaryListenerEnabled=true' is enabled
• Restrict network access to Nexus Repository Manager instances until remediation is applied
• Apply remediation as described in vendor documentation
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD vulnerability detail page provide information on the vulnerability, its impact, and affected versions. Evidence from Sonatype indicates that the vulnerability affects Nexus Repository Manager versions 3.0.0 through 3.70.5 and requires the non-default configuration 'nexus.orient.binaryListenerEnabled=true' to be enabled. Defenders should verify the configuration and assess exposure.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.