CVE-2026-77124 Sonatype CVE debrief

Who should care

Defenders and administrators of Sonatype Nexus Repository Manager 3 should assess exposure and verify their version, user permissions, and script execution settings to prevent unauthorized script execution. They need to prioritize verifying their Nexus Repository Manager version, checking for existing scripts that could be executed, reviewing user permissions, and ensuring that script execution is properly disabled if intended.

Why it matters

CVE-2026-77124 is a high-severity vulnerability in Sonatype Nexus Repository Manager 3 that allows users with script-execution permission to run scripts even when administratively set to disable script execution. Defenders should verify their version, review user permissions, and update if necessary to prevent unauthorized script execution.

• Defenders need to verify their Nexus Repository Manager version and check for existing scripts that could be executed
• Review user permissions to ensure script execution is properly disabled if intended
• Update to version 3.96.0 or later if vulnerable to prevent unauthorized script execution

Technical summary

The script execution endpoint in affected versions of Nexus Repository 3 did not verify whether script execution had been administratively disabled. This allowed users with script-execution permission to run previously created scripts even after an administrator set nexus.scripts.allowCreation=false. The issue affects versions from 3.21.2 up to but not including 3.96.0, and defenders should assess exposure and verify their version, user permissions, and script execution settings to prevent unauthorized script execution.

Defensive priority

Defenders should prioritize verifying their Nexus Repository Manager version and checking for any existing scripts that could be executed. They should also review user permissions and ensure that script execution is properly disabled if intended.

Recommended defensive actions

• Verify Nexus Repository Manager version and check for existing scripts that could be executed
• Review user permissions and ensure script execution is properly disabled if intended
• Update to version 3.96.0 or later if vulnerable
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details about the vulnerability, its impact, and affected versions. However, additional information about potential exploitation or specific attacks is not available in the provided sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.