A repository server that answers on the public internet says what it is in its page title or headers, and a Nexus server can also say which version it is. We counted them. This report covers servers that identify as Sonatype Nexus Repository, JFrog Artifactory, Harbor, a Docker registry, pypiserver, Verdaccio or ProGet, as the Shodan search engine saw them between August 29, 2026 and October 6, 2026.
It shows public exposure and nothing else. A server inside a private network is invisible to it, and a banner reports a version without proving it. The methods section says what we counted, and the table at the end names the dataset field behind every number on this page.
at least 7,168
Sonatype Nexus Repository servers on the public internet, counted by page title.
at least 2,590
JFrog Artifactory servers on the public internet, counted by page title and by header.
61.8%
of 4,114 Nexus servers reporting a version in a 24-country sample report a Nexus 3 line at least 10 minor versions behind the newest, 3.96.
132
servers still reporting Nexus 2 in a 24-country sample, after its end of life on June 30, 2024.
How many answer on the public internet
Counting by page title, at least 7,168 Sonatype Nexus Repository servers answer on the public internet, 5,400 of them outside China. Counting by page title and by header, at least 2,590 JFrog Artifactory servers do.
These are floors. Nexus and Artifactory are counted by what their page title or headers say, and a server with a blank or custom title is not counted. The Nexus title searches overlap, so we report the larger and do not add them. The Artifactory title and header searches do not overlap, so we add them.
Harbor is not in the chart, on purpose. The page title Harbor also belongs to unrelated software, including a radio-streaming tool, so Harbor cannot be counted worldwide with confidence. In a capped sample of 6,000 rows from the 24 countries our version sample covers, 1,839 servers carry the exact title Harbor. Read that as a floor for those countries, not a worldwide count.
The Docker registry figure counts every server that answers with the Docker registry v2 API header. It can include the registry inside a Harbor deployment and test registries, so it is not a count of standalone registries.
How far behind they are
Version data comes from the banners of Nexus servers in the 24 countries our sample covers. Of the 4,114 Nexus servers there that report a version, 156 (3.8%) report the newest line, 3.96. 2,542 servers (61.8%) report a Nexus 3 line at least 10 minor versions behind it, and 132 (3.2%) still report Nexus 2.
The banner names an edition too, and 8.5% of these servers report Pro:
Artifactory banners rarely carry a version, so its version figure comes from a smaller fingerprinted set of 150 servers. The set was not drawn at random. It holds only Artifactory servers our discovery found that have a hostname and showed their version to an anonymous request, so it is not a census. We have not measured which way that leans on version. In it, 31 of 150 report a major version older than Artifactory 7.
A banner can be wrong. An operator can hide or change it, and a proxy in front of a server can answer with its own. These counts are what servers report, not what they are proven to be.
The Nexus 2 holdouts
Sonatype has ended Nexus Repository 2. Its Nexus Repository 2 page gives June 30, 2024 as the end of life, and its sunsetting information gives June 30, 2025 as the sunset. Its version status page says that from the sunset, Sonatype releases no additional features or bug fixes for Nexus Repository 2.
In our 24-country sample, 132 servers with a Nexus page title still report a Nexus 2 version. We do not have a reliable worldwide count, so this is a floor from the sample, not a worldwide figure.
If your team still operates Nexus 2, our Nexus Repository 2 end-of-life page lists the CVEs published after the sunset that affect it and what the move to Nexus Repository 3 involves, and Sonatype’s guide to upgrading from Nexus Repository 2 describes that move in full.
Versions older than where the NVD ranges end
NIST’s National Vulnerability Database (NVD) lists the versions each CVE affects. Of the 4,114 title-confirmed Nexus servers in our 24-country sample whose banner names a version, 96.2% report a version older than 3.96.0, where NVD’s affected ranges for two high-severity CVEs, CVE-2026-77124 and CVE-2026-77125, end. The other 156 report 3.96.0 or newer. Of the 1,112 that report 3.90 or newer, 86% still report a version older than 3.96.0.
We read NVD on October 6, 2026 and checked each reported version against the affected ranges of the 64 CVEs it then listed under the Sonatype Nexus Repository Manager product. The result is the same as counting the servers that do not report 3.96.0 or newer, so read it as version age, not as independent evidence about CVEs.
| Nexus servers | Count | Share older than 3.96.0 |
|---|---|---|
| All that report a version | 4,114 | 96.2% |
| Version 3.90 or newer | 1,112 | 86% |
- Source
- The CVEs NIST NVD lists under the Sonatype Nexus Repository Manager product, as of 2026-10-06T09:54Z (64 of them); each banner version was checked against the affected version ranges NVD gives
- What drives it
- a handful of 2026 CVEs with wide affected ranges flag most versions, including recent ones; the share says versions are inside NVD affected ranges, not that hosts are exploitable
- Caveat
- NVD range data can undercount (CVEs without CPE ranges are missed); banner versions are reported, not proven. Matches a version to any CVE whose affected range includes it, regardless of exploit conditions.
Read the figure as the share of servers that report a version older than 3.96.0, not as a count of servers that can be attacked. You can read each CVE record in the NVD.
What to do about it
If your team operates a repository server like these, check the version it reports against the vendor’s current release and security advisories. Take it off the public internet if nothing outside your network needs to reach it. And if it is still Nexus 2, plan the move off it.
Or stop operating a repository server. CloudRepo is a hosted repository for Maven, Python, npm and Docker, with no per-user pricing, so there is no repository server for your team to install or upgrade. See pricing.
How we counted
Where the numbers come from. Worldwide counts are Shodan search totals taken on October 6, 2026. Version data comes from Shodan banner rows seen between August 29, 2026 and October 6, 2026 in 24 countries: United States, Germany, United Kingdom, Netherlands, France, Canada, Australia, Ireland, Sweden, Switzerland, Austria, Denmark, Finland, Norway, Belgium, Spain, Italy, Poland, Czechia, Portugal, Brazil, Israel, Singapore, Japan. That sample is not a census and not random: it covers only those countries and only servers whose banner names a version, and Shodan returned errors near the end of the largest pull, so some servers in those countries are missing from it. We have not measured which way those choices and gaps lean, so read each share as a share of this sample, not of all Nexus servers.
A server is not a company. Each count is of addresses and ports that answered. An organization can have several servers, so these numbers are not a count of companies.
The decoy farm. The plain banner search for Nexus is polluted by a decoy farm: identical fake banners on cloud hosting that claim old Nexus versions while serving unrelated pages. We do not use that search as a count. We count Nexus only where the page title says Nexus. Of 25,433 unique hosts in the Nexus banner rows we pulled, we excluded 21,311 as decoys or as having no Nexus page title. A real Nexus server with a blank title is excluded too, which is why every Nexus figure is a floor.
Overlapping searches. The Nexus title searches overlap: we report the larger, 7,168, and the other matched 3,445. The Artifactory title and header searches do not overlap, because a Shodan search for both together returns nothing. The title search matched 2,008 and the header search 582, so the Artifactory floor is their total, 2,590.
Harbor. Of 6,000 rows pulled for the title Harbor, 4,161 were other software and are excluded. Only servers titled exactly Harbor count.
Docker registries. The Docker registry v2 API header cannot tell a standalone registry from the registry inside a Harbor deployment, and it may include test registries.
China. Worldwide counts include China, and we give the Nexus floor without it too.
Versions and CVEs. A banner reports a version; it does not prove it. The Artifactory version figure comes from a smaller fingerprinted set, with its size stated wherever it is used. That set is not random and not a census: it holds only Artifactory servers our discovery found that have a hostname and showed their version to an anonymous request. We have not measured which way that leans on version. The NVD figures cover the title-confirmed Nexus servers in the version sample and compare each reported version with 3.96.0, as described above.
What is not here. The dataset behind this page holds aggregate counts only. It contains no addresses, hostnames or organization names, and neither does this page.
Every figure on this page
Each figure below is computed at build time from the committed dataset (the version groups and the far-behind threshold are set in the same code), and a check in our repository fails when the page and the dataset disagree.
- Worldwide counts taken
- October 6, 2026
- observation_dates.worldwide_counts_taken
- First banner row in the version sample
- August 29, 2026
- observation_dates.shodan_banner_rows_from
- Last banner row in the version sample
- October 6, 2026
- observation_dates.to
- Countries in the version sample
- 24
- target_countries (length)
- Nexus servers worldwide, floor
- 7,168
- counts_by_product.nexus_title_sonatype_nexus_repository.worldwide (the larger of nexus_title_sonatype_nexus_repository and nexus_title_nexus_repository_manager; they overlap)
- Nexus servers outside China, floor
- 5,400
- counts_by_product.nexus_title_sonatype_nexus_repository.excluding_cn (the larger of nexus_title_sonatype_nexus_repository and nexus_title_nexus_repository_manager; they overlap)
- Second Nexus title query, worldwide (overlaps the first)
- 3,445
- the smaller of counts_by_product.nexus_title_sonatype_nexus_repository.worldwide and .nexus_title_nexus_repository_manager.worldwide
- JFrog Artifactory servers worldwide, floor
- 2,590
- artifactory_combined_floor.worldwide (the title and header queries do not overlap)
- Artifactory title query, worldwide (does not overlap the header query)
- 2,008
- counts_by_product.artifactory_title_jfrog.worldwide
- Artifactory header query, worldwide (does not overlap the title query)
- 582
- counts_by_product.artifactory_x_artifactory_id.worldwide
- Docker registry v2 API servers worldwide
- 1,832
- counts_by_product.docker_registry_v2.worldwide
- pypiserver servers worldwide
- 345
- counts_by_product.pypiserver.worldwide
- Verdaccio servers worldwide
- 321
- counts_by_product.verdaccio.worldwide
- ProGet servers worldwide
- 94
- counts_by_product.proget.worldwide
- Harbor servers in the target-country sample, floor
- 1,839
- harbor.in_target_countries_exact_title_sample
- Rows pulled for the Harbor title
- 6,000
- decoys_excluded.harbor_title_query_rows_unique_pulled
- Harbor-titled rows excluded as other software
- 4,161
- decoys_excluded.harbor_rows_excluded_as_non_harbor
- Unique hosts in the pulled Nexus banner rows
- 25,433
- decoys_excluded.nexus_raw_banner_unique_pulled_total
- Pulled Nexus banner hosts excluded (decoy or no Nexus title)
- 21,311
- decoys_excluded.nexus_decoy_or_untitled_excluded
- Nexus servers reporting a version, target countries
- 4,114
- nexus_version_distribution_target_countries.n_unique_hosts_with_banner_version
- Of them, reporting Nexus 3
- 3,982
- sum of the 3.x keys of nexus_version_distribution_target_countries.by_major_minor
- Of them, reporting Nexus 2
- 132
- nexus_2_eol.in_target_countries_title_confirmed_unique_hosts
- Nexus 2 share of the servers reporting a version
- 3.2%
- nexus_2_eol.in_target_countries_title_confirmed_unique_hosts / nexus_version_distribution_target_countries.n_unique_hosts_with_banner_version
- Newest Nexus 3 version line
- 3.96
- latest_versions_assumed.nexus (major.minor)
- Nexus 3 servers reporting the newest line
- 156
- nexus_version_distribution_target_countries.by_major_minor["3.96"]
- Share on the newest line, of all Nexus servers reporting a version
- 3.8%
- nexus_version_distribution_target_countries.by_major_minor["3.96"] / nexus_version_distribution_target_countries.n_unique_hosts_with_banner_version
- Nexus 3 servers 10 or more minor versions behind
- 2,542
- sum of the 3.x keys of nexus_version_distribution_target_countries.by_major_minor at least 10 below the newest line
- Share 10 or more minor versions behind, of all Nexus servers reporting a version
- 61.8%
- those keys / nexus_version_distribution_target_countries.n_unique_hosts_with_banner_version
- Threshold for "far behind", in minor versions
- 10
- a threshold set in the figures code (FAR_BEHIND), not a dataset field
- Share reporting the Pro edition
- 8.5%
- nexus_version_distribution_target_countries.by_edition.PRO / nexus_version_distribution_target_countries.n_unique_hosts_with_banner_version
- Nexus 2 end of life
- June 30, 2024
- nexus_2_eol.note (EOL date), as Sonatype states it
- Nexus 2 sunset
- June 30, 2025
- nexus_2_eol.note (sunset date), as Sonatype states it
- Artifactory servers in the fingerprinted set (not a census)
- 150
- artifactory_version_distribution_fingerprinted.n_hosts
- Of them, reporting a major version below 7
- 31
- artifactory_version_distribution_fingerprinted.n_major_below_7
- Nexus servers, confirmed by page title, reporting a version (the population of the NVD figure)
- 4,114
- nexus_banner_cve_exposure.hosts_with_version_and_nvd_result
- NVD read on
- October 6, 2026
- nexus_banner_cve_exposure.nvd_read_utc (the date)
- NVD read, as the dataset stamps it
- 2026-10-06T09:54Z
- nexus_banner_cve_exposure.nvd_read_utc
- NVD CVEs listed under the Sonatype Nexus Repository Manager product that the reported versions were checked against, as of the NVD read
- 64
- nexus_banner_cve_exposure.n_nvd_cves_considered
- The release where NVD's affected ranges for two high-severity CVEs end
- 3.96.0
- nexus_banner_cve_exposure.equivalent_to (the release it names; the 3.96 is in the field name nexus_banner_cve_exposure.hosts_on_3_96_or_newer)
- Of them, servers reporting 3.96.0 or newer
- 156
- nexus_banner_cve_exposure.hosts_on_3_96_or_newer
- Share of them reporting a version older than 3.96.0
- 96.2%
- nexus_banner_cve_exposure.share_reporting_version_with_known_critical_or_high_cve (equal to the share of nexus_banner_cve_exposure.hosts_with_version_and_nvd_result that is not in nexus_banner_cve_exposure.hosts_on_3_96_or_newer)
- Version line from which the second share counts
- 3.90
- nexus_banner_cve_exposure.hosts_reporting_3_90_or_newer (the 3.90 is in the field name)
- Nexus servers, confirmed by page title, reporting 3.90 or newer
- 1,112
- nexus_banner_cve_exposure.hosts_reporting_3_90_or_newer
- Share of those reporting a version older than 3.96.0
- 86%
- nexus_banner_cve_exposure.share_of_those_with_known_critical_or_high_cve (equal to the share of nexus_banner_cve_exposure.hosts_reporting_3_90_or_newer that is not in nexus_banner_cve_exposure.hosts_on_3_96_or_newer)