Nexus 3.15.1 46 known CVEs

Support status: Not listed. This version predates Sonatype's versions status page.

Sonatype Nexus Repository 3.15.1
From Sonatype's release notes and support dates, and NVD
  1. Released not published
  2. Support status Not listed
  3. Latest release 3.97.2, October 23, 2026
  4. Behind latest not computable
  5. Lowest upgrade that fixes 45 of 46 3.97.0
  6. Critical 2 High 16 Medium 25 Low 3
Known CVEs 46
The same 46 as 3 other releases, listed under the table
Release date not published by the vendor; Sonatype lists 3.15.1 only in its CVE records.

A lookup, not a scan of your server. 42 of the 46 come from NVD's exact CPE match, and 4 more from Sonatype's advisories that NVD has not analyzed. Pulled October 23, 2026. Sources and method

Tired of patching Nexus yourself?

This is what we do. We host your Maven, npm, PyPI and Docker repositories, so there's no Nexus server to upgrade or patch.

Our migration tool, free to use with CloudRepo, moves your hosted repositories over from Nexus 3 and checks every file.

Start free trial

14 days free. No credit card required.

Or book a call with Chris

Upgrade path

3.97.0 fixes 45 of these 46. For the 46th (CVE-2026-0600), Sonatype publishes a workaround, not a fix.

What upgrading costs, in Sonatype's words

  • If your server runs on OrientDB, Sonatype says "Before updating to a release after 3.70.x, you must migrate off from the Orient database while upgrading Java." (Sonatype's upgrade page, read October 31, 2026)
  • The same page says "Nexus Repository 3.70.x is the last release that supports OrientDB." (Sonatype's upgrade page, read October 31, 2026)
  • Sonatype lists the 3.70.x releases as Sunsetted, with a sunset date of January 9, 2026. (Sonatype's versions status page, read October 31, 2026)
  • If you run the free edition, Sonatype says "As of version 3.77.0, the free edition of Nexus Repository is now called Sonatype Nexus Repository Community Edition." (Sonatype's 3.77.0 release notes, read October 31, 2026)
  • Sonatype gives "the Community Edition usage limits of 40,000 total components or 100,000 requests per day", and says that over a limit "users are not able to add new components until the deployment returns to being under both of these limits." (Sonatype's Usage Center page, read October 31, 2026)

Both costs, with every source: Nexus Community Edition limits and Stuck on Nexus 3.70 (OrientDB)? Upgrade or move.

No known security breaches in our history.

The 46 CVEs that affect 3.15.1

Sorted by severity. A CVE counts when either NVD or Sonatype says this version is affected; both verdicts are shown. Latest release: 3.97.2.

CVEs that affect Sonatype Nexus Repository 3.15.1
CVE Severity NVD Sonatype Fix
CVE-2019-9629 July 8, 2019 Critical 9.8 CVSS 3.0 9.8, rated by NVD yes no Sonatype CNA range No Sonatype CNA range; NVD's range ends before 3.17.0. See Sonatype's advisory.
Sonatype Nexus Repository Manager before 3.17.0 establishes a default administrator user with weak defaults (fixed credentials).

NVD configuration (NVD status: Modified): before 3.17.0.

Sonatype publishes no affected range in the CVE record (assigned by MITRE).

NVD record Sonatype advisory

CVE-2026-5189 April 15, 2026 Critical 9.8 CVSS 3.1 9.8, rated by NVD yes yes 3.71.0 nearest fix; none on your branch
CWE-798: Use of Hard-coded Credentials in Sonatype Nexus Repository Manager versions 3.0.0 through 3.70.5 allows an unauthenticated attacker with network access to gain unauthorized read/write access to the internal database and execute arbitrary OS commands as the Nexus process user.

Exploitation requires the non-default nexus.orient.binaryListenerEnabled=true configuration to be enabled.

NVD configuration (NVD status: Analyzed): from 3.0.0 (including), before 3.71.0.

Sonatype: All Sonatype Nexus Repository 3.x CE/Pro versions 3.0.0 through 3.70.5.

NVD record Sonatype advisory

CVE-2020-10199 April 1, 2020 High 8.8 CVSS 3.1 8.8, rated by NVD yes yes 3.21.2 nearest fix; none on your branch
Sonatype Nexus Repository before 3.21.2 allows JavaEL Injection (issue 1 of 2).

NVD configuration (NVD status: Analyzed): before 3.21.2.

Sonatype: All previous Nexus Repository 3.x OSS/Pro versions up to and including 3.21.1.

NVD record Sonatype advisory

CVE-2020-11444 April 2, 2020 High 8.8 CVSS 3.1 8.8, rated by NVD yes yes 3.22.0 nearest fix; none on your branch
Sonatype Nexus Repository Manager 3.x up to and including 3.21.2 has Incorrect Access Control.

NVD configuration (NVD status: Modified): from 3.0.0 (including), through 3.21.2.

Sonatype: All previous Nexus Repository 3 OSS/Pro versions up to and including 3.21.2.

NVD record Sonatype advisory

CVE-2020-15871 July 31, 2020 High 8.8 CVSS 3.1 8.8, rated by NVD yes no Sonatype CNA range No Sonatype CNA range; NVD's range ends before 3.25.1. See Sonatype's advisory.
Sonatype Nexus Repository Manager OSS/Pro version before 3.25.1 allows Remote Code Execution.

NVD configuration (NVD status: Analyzed): before 3.25.1.

Sonatype publishes no affected range in the CVE record (assigned by MITRE).

NVD record Sonatype advisory

CVE-2026-17600 August 7, 2026 High 8.8 CVSS 3.1 8.8, rated by NVD yes yes 3.95.0 nearest fix; none on your branch
Sonatype Nexus Repository 3 did not immediately terminate a user's active login session or revoke their cached permissions when that user's account was deleted, deactivated, or had its password changed.

A user whose account was already logged in at the time of one of these actions could continue using their existing session to interact with the repository as though the account were still active, until that session independently expired. Depending on the permissions previously held, this could allow continued unauthorized access to read, modify, or delete repository content after access was intended to be revoked.

NVD configuration (NVD status: Analyzed): from 3.0.0 (including), before 3.95.0.

Sonatype: All Sonatype Nexus Repository CE/Pro versions prior to 3.95.0.

NVD record Sonatype advisory

CVE-2026-97712 October 15, 2026 High 8.7 CVSS 4.0 8.7, rated by Sonatype (CNA) no NVD data yes 3.97.0 nearest fix; none on your branch
Sonatype Nexus Repository 3 allows a user that holds the role create or role update permission to grant roles and privileges that the account does not hold.

This can give the user more access than intended, up to full administrative access.

NVD has published no version configuration for this record (NVD status: Awaiting Analysis).

Sonatype: All Sonatype Nexus Repository 3 CE/Pro versions from 3.0.0 up to and including 3.96.4.

NVD record Sonatype advisory

CVE-2021-40143 September 7, 2021 High 8.2 CVSS 3.1 8.2, rated by NVD yes yes 3.34.0 nearest fix; none on your branch
Sonatype Nexus Repository 3.x through 3.33.1-01 is vulnerable to an HTTP header injection.

By sending a crafted HTTP request, a remote attacker may disclose sensitive information or request external resources from a vulnerable instance.

NVD configuration (NVD status: Analyzed): from 3.0.0 (including), before 3.34.1-01.

Sonatype: Nexus Repository 3 versions up to and including 3.33.1.

NVD record Sonatype advisory

CVE-2026-14646 July 14, 2026 High 7.7 CVSS 3.1 7.7, rated by NVD yes yes 3.94.0 nearest fix; none on your branch
Nexus Repository 3 did not apply its existing Server-Side Request Forgery (SSRF) protections to HTTP redirect targets returned by proxy repository upstream servers.

Any user with read access to a proxy repository backed by an attacker-controlled or compromised upstream server - including an anonymous user, if anonymous access is enabled - could receive a response from an internal network address or cloud metadata endpoint as repository content, potentially exposing sensitive information such as cloud IAM credentials.

NVD configuration (NVD status: Analyzed): from 3.0.0 (including), before 3.94.0.

Sonatype: All Sonatype Nexus Repository 3 CE/Pro versions from 3.0.0 up to and including 3.93.x.

NVD record Sonatype advisory

CVE-2019-9630 July 8, 2019 High 7.5 CVSS 3.0 7.5, rated by NVD yes no Sonatype CNA range No Sonatype CNA range; NVD's range ends before 3.17.0. See Sonatype's advisory.
Sonatype Nexus Repository Manager before 3.17.0 has a weak default of giving any unauthenticated user read permissions on the repository files and images.

NVD configuration (NVD status: Modified): before 3.17.0.

Sonatype publishes no affected range in the CVE record (assigned by MITRE).

NVD record Sonatype advisory

CVE-2020-15868 August 12, 2020 High 7.5 CVSS 3.1 7.5, rated by NVD yes no Sonatype CNA range No Sonatype CNA range; NVD's range ends before 3.26.0. See Sonatype's advisory.
Sonatype Nexus Repository Manager OSS/Pro before 3.26.0 has Incorrect Access Control.

NVD configuration (NVD status: Modified): before 3.26.0.

Sonatype publishes no affected range in the CVE record (assigned by MITRE).

NVD record Sonatype advisory

CVE-2024-4956 May 16, 2024 High 7.5 CVSS 3.1 7.5, rated by Sonatype (CNA) no NVD data yes 3.68.1 nearest fix; none on your branch
Path Traversal in Sonatype Nexus Repository 3 allows an unauthenticated attacker to read system files.

Fixed in version 3.68.1.

NVD has published no version configuration for this record (NVD status: Deferred).

Sonatype: All previous Sonatype Nexus Repository 3.x OSS/Pro versions up to and including 3.68.0.

NVD record Sonatype advisory

CVE-2026-11403 July 14, 2026 High 7.5 CVSS 3.1 7.5, rated by NVD yes yes 3.93.0 nearest fix; none on your branch
A vulnerability in Sonatype Nexus Repository Manager's format-specific API key generation may allow a remote attacker to gain unauthorized access to repository operations as a targeted user.

A format-specific API key realm (NuGet API Key, Docker Bearer Token, or npm Bearer Token) must be enabled and the targeted user must have an active API key for this vulnerability to be exploitable.

NVD configuration (NVD status: Analyzed): from 3.0.0 (including), before 3.93.0.

Sonatype: All Sonatype Nexus Repository 3.x CE/Pro versions before 3.93.0.

NVD record Sonatype advisory

CVE-2026-3329 June 11, 2026 High 7.5 CVSS 3.1 7.5, rated by NVD yes yes 3.93.0 nearest fix; none on your branch
A remote unauthenticated attacker may be able to conduct credential-guessing attacks against user accounts in Sonatype Nexus Repository via authentication endpoints.

NVD configuration (NVD status: Analyzed): from 3.0.0 (including), before 3.93.0.

Sonatype: All Sonatype Nexus Repository versions from 3.0.0 up to and including 3.92.x.

NVD record Sonatype advisory

CVE-2019-16530 October 21, 2019 High 7.2 CVSS 3.1 7.2, rated by NVD yes yes 3.19.0 nearest fix; none on your branch
Sonatype Nexus Repository Manager 2.x before 2.14.15 and 3.x before 3.19, and IQ Server before 72, has remote code execution.

NVD configuration (NVD status: Modified): from 2.0.0 (including), through 2.14.14; from 3.0.0 (including), through 3.18.1.

Sonatype: Nexus Repository 2 versions up to and including 2.14.14; Nexus Repository 3 versions up to and including 3.18.1; IQ Server versions up to and including 72.

NVD record Sonatype advisory

CVE-2020-10204 April 1, 2020 High 7.2 CVSS 3.1 7.2, rated by NVD yes no Sonatype CNA range No Sonatype CNA range; NVD's range ends before 3.21.2. See Sonatype's advisory.
Sonatype Nexus Repository before 3.21.2 allows Remote Code Execution.

NVD configuration (NVD status: Modified): before 3.21.2.

Sonatype publishes no affected range in the CVE record (assigned by MITRE).

NVD record Sonatype advisory

CVE-2026-10748 June 16, 2026 High 7.2 CVSS 3.1 7.2, rated by NVD yes yes 3.92.0 nearest fix; none on your branch
An authenticated user with the nx-licensing-create privilege can upload a specially crafted license file to execute arbitrary operating system commands as the Nexus process user in Sonatype Nexus Repository 3 versions before 3.92.0.

NVD configuration (NVD status: Analyzed): from 3.0.0 (including), before 3.92.0.

Sonatype: All Sonatype Nexus Repository 3.x CE/Pro versions before 3.92.0.

NVD record Sonatype advisory

CVE-2026-17593 August 7, 2026 High 7.2 CVSS 3.1 7.2, rated by NVD yes yes 3.95.0 nearest fix; none on your branch
An account holding the nexus:settings:update permission in Nexus Repository 3 (or the equivalent nexus:settings permission in the legacy Nexus Repository 2) could submit arbitrary values as realm identifiers through an internal configuration API that did not validate them against the set of registered realms.

Because unrecognized entries were persisted and re-evaluated on every realm load via a legacy code path, this could result in unintended code executing inside the Nexus Repository process, and in some cases a persistent authentication lockout that was not visible through the administrative UI.

NVD configuration (NVD status: Analyzed): from 2.8.0 (including), before 3.95.0.

Sonatype: All previous Sonatype Nexus Repository CE/Pro versions from 2.8.0 up to and including 3.94.x.

NVD record Sonatype advisory

CVE-2026-97666 October 15, 2026 Medium 6.9 CVSS 4.0 6.9, rated by Sonatype (CNA) no NVD data yes 3.97.0 nearest fix; none on your branch
Sonatype Nexus Repository 3 allows an unauthenticated remote attacker to supply attacker-controlled input to a Java class loading call through an ExtDirect endpoint.

This allows the attacker to learn whether specific classes are present in the application. The issue does not by itself allow code execution.

NVD has published no version configuration for this record (NVD status: Awaiting Analysis).

Sonatype: All previous Sonatype Nexus Repository 3 CE/Pro versions up to and including 3.96.x.

NVD record Sonatype advisory

CVE-2020-29436 December 17, 2020 Medium 6.5 CVSS 3.1 6.5, rated by NVD yes no Sonatype CNA range No Sonatype CNA range; NVD's range ends before 3.29.0. See Sonatype's advisory.
Sonatype Nexus Repository Manager 3.x before 3.29.0 allows a user with admin privileges to configure the system to gain access to content outside of NXRM via an XXE vulnerability.

Fixed in version 3.29.0.

NVD configuration (NVD status: Modified): from 3.0.0 (including), before 3.29.0.

Sonatype publishes no affected range in the CVE record (assigned by MITRE).

NVD record Sonatype advisory

CVE-2024-5764 October 23, 2024 Medium 6.5 CVSS 3.1 6.5, rated by NVD yes yes 3.73.0 nearest fix; none on your branch
Use of Hard-coded Credentials vulnerability in Sonatype Nexus Repository has been discovered in the code responsible for encrypting any secrets stored in the Nexus Repository configuration database (SMTP or HTTP proxy credentials, user tokens, tokens, among others).

The affected versions relied on a static hard-coded encryption passphrase. While it was possible for an administrator to define an alternate encryption passphrase, it could only be done at first boot and not updated. This issue affects Nexus Repository: from 3.0.0 through 3.72.0.

NVD configuration (NVD status: Analyzed): from 3.0.0 (including), before 3.73.0.

Sonatype: All previous Sonatype Nexus Repository Manager 3.x OSS/Pro versions up to and including 3.72.0.

NVD record Sonatype advisory

CVE-2026-77123 September 2, 2026 Medium 6.5 CVSS 3.1 6.5, rated by NVD yes yes 3.96.0 nearest fix; none on your branch
Nexus Repository 3 contains a sensitive information disclosure vulnerability in the capability read API.

An account holding the nexus:capabilities:read privilege can retrieve the plaintext shared secret configured on a webhook capability, which is intended to be masked from all API responses. This issue affects Nexus Repository 3 versions 3.2.0 through 3.95.x, and is fixed in version 3.96.0.

NVD configuration (NVD status: Analyzed): from 3.2.0 (including), before 3.96.0.

Sonatype: All Sonatype Nexus Repository 3 CE/Pro versions from 3.2.0 up to and including 3.95.x.

NVD record Sonatype advisory

CVE-2026-0600 January 14, 2026 Medium 6.2 CVSS 4.0 6.2, rated by Sonatype (CNA) no NVD data yes No fixed version. Sonatype names a workaround from Sonatype Nexus Repository 3.88.0 (CE/Pro).
Server-Side Request Forgery (SSRF) vulnerability in Sonatype Nexus Repository 3 versions 3.0.0 and later allows authenticated administrators to configure proxy repositories with URLs that can access unintended network destinations, potentially including cloud metadata services and internal network resources.

A workaround configuration is available starting in version 3.88.0, but the product remains vulnerable by default.

NVD has published no version configuration for this record (NVD status: Deferred).

Sonatype: Sonatype Nexus Repository 3.0.0 and later (CE/Pro).

NVD record Sonatype advisory

CVE-2020-15870 July 31, 2020 Medium 6.1 CVSS 3.1 6.1, rated by NVD yes yes 3.25.1 nearest fix; none on your branch
Sonatype Nexus Repository Manager OSS/Pro versions before 3.25.1 allow XSS (Issue 2 of 2).

NVD configuration (NVD status: Analyzed): before 3.25.1.

Sonatype: All previous Nexus Repository 3 OSS/Pro versions up to and including 3.25.0.

NVD record Sonatype advisory

CVE-2026-3438 April 8, 2026 Medium 6.1 CVSS 3.1 6.1, rated by NVD yes yes 3.91.0 nearest fix; none on your branch
A reflected cross-site scripting vulnerability exists in Sonatype Nexus Repository versions 3.0.0 through 3.90.2 that allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser through a specially crafted URL.

Exploitation requires user interaction.

NVD configuration (NVD status: Analyzed): from 3.0.0 (including), before 3.91.0.

Sonatype: All Sonatype Nexus Repository 3.x CE/Pro versions up to and including 3.90.x.

NVD record Sonatype advisory

CVE-2026-14645 July 14, 2026 Medium 5.5 CVSS 3.1 5.5, rated by NVD yes yes 3.94.0 nearest fix; none on your branch
Nexus Repository 3 does not validate the destination of the "Webhook: Global" capability's configured URL before making an outbound HTTP request, allowing a user holding the Capability Administration permission to cause the server to send requests to internal network locations (Server-Side Request Forgery).

This permission is granted by role assignment, independent of authentication status, so an unauthenticated user could also trigger this behavior if the anonymous role has been granted the permission.

NVD configuration (NVD status: Analyzed): from 3.0.0 (including), before 3.94.0.

Sonatype: All previous Sonatype Nexus Repository 3 CE/Pro versions up to and including 3.93.x.

NVD record Sonatype advisory

CVE-2019-14469 August 22, 2019 Medium 5.4 CVSS 3.0 5.4, rated by NVD yes yes 3.18.0 nearest fix; none on your branch
In Nexus Repository Manager before 3.18.0, users with elevated privileges can create stored XSS.

NVD configuration (NVD status: Modified): from 3.14.0 (including), through 3.17.0.

Sonatype: Nexus Repository 3 versions starting in 3.14.0 up to and including 3.17.0.

NVD record Sonatype advisory

CVE-2020-15869 July 31, 2020 Medium 5.4 CVSS 3.1 5.4, rated by NVD yes yes 3.25.1 nearest fix; none on your branch
Sonatype Nexus Repository Manager OSS/Pro versions before 3.25.1 allow XSS (issue 1 of 2).

NVD configuration (NVD status: Analyzed): before 3.25.1.

Sonatype: All previous Nexus Repository Manager 3 OSS/Pro versions up to and including 3.25.0.

NVD record Sonatype advisory

CVE-2021-37152 August 10, 2021 Medium 5.4 CVSS 3.1 5.4, rated by NVD yes yes 3.33.0 nearest fix; none on your branch
Multiple XSS issues exist in Sonatype Nexus Repository Manager 3 before 3.33.0.

An authenticated attacker with the ability to add HTML files to a repository could redirect users to Nexus Repository Manager’s pages with code modifications.

NVD configuration (NVD status: Modified): from 3.0.0 (including), before 3.33.0.

Sonatype: Nexus Repository 3 versions up to and including 3.32.0.

NVD record Sonatype advisory

CVE-2026-7308 May 11, 2026 Medium 5.4 CVSS 3.1 5.4, rated by NVD yes yes 3.92.0 nearest fix; none on your branch
An authenticated user with upload permission to a hosted repository can store content that causes arbitrary JavaScript to execute in the browser of any user who browses that repository directory via the HTML index page in Sonatype Nexus Repository versions 3.6.0 through versions before 3.92.0.

This could allow the attacker to perform actions in the context of the victim's session.

NVD configuration (NVD status: Analyzed): from 3.6.0 (including), before 3.93.0.

Sonatype: Sonatype Nexus Repository 3.6.0 through 3.91.x (CE/Pro).

NVD record Sonatype advisory

CVE-2021-30635 April 27, 2021 Medium 5.3 CVSS 3.1 5.3, rated by NVD yes yes 3.30.1 nearest fix; none on your branch
Sonatype Nexus Repository Manager 3.x before 3.30.1 allows a remote attacker to get a list of files and directories that exist in a UI-related folder via directory traversal (no customer-specific data is exposed).

NVD configuration (NVD status: Modified): from 3.0 (including), before 3.30.1.

Sonatype: Nexus Repository Manager 3 versions up to and including 3.30.0.

NVD record Sonatype advisory

CVE-2026-7494 July 14, 2026 Medium 5.0 CVSS 3.1 5.0, rated by NVD yes yes 3.94.0 nearest fix; none on your branch
Nexus Repository 3 is vulnerable to Server-Side Request Forgery (SSRF) via the SSL Certificate Retrieval endpoint.

A user holding the nexus:ssl-truststore:read permission could cause the server to initiate outbound connections to internal or otherwise restricted network hosts. This issue affects Nexus Repository 3.0.0 through versions prior to 3.94.0.

NVD configuration (NVD status: Analyzed): from 3.0.0 (including), before 3.94.0.

Sonatype: Sonatype Nexus Repository 3 CE/Pro versions 3.0.0 up to and including 3.93.x.

NVD record Sonatype advisory

CVE-2020-11415 April 27, 2020 Medium 4.9 CVSS 3.1 4.9, rated by NVD yes no Sonatype CNA range No Sonatype CNA range; NVD's range ends before 3.22.1. See Sonatype's advisory.
An issue was discovered in Sonatype Nexus Repository Manager 2.x before 2.14.17 and 3.x before 3.22.1.

Admin users can retrieve the LDAP server system username/password (as configured in nxrm) in cleartext.

NVD configuration (NVD status: Modified): from 2.0 (including), before 2.14.17; from 3.0 (including), before 3.22.1.

Sonatype publishes no affected range in the CVE record (assigned by MITRE).

NVD record Sonatype advisory

CVE-2020-24622 August 25, 2020 Medium 4.9 CVSS 3.1 4.9, rated by NVD yes yes 3.27.0 nearest fix; none on your branch
In Sonatype Nexus Repository 3.26.1, an S3 secret key can be exposed by an admin user.

NVD configuration (NVD status: Modified): from 3.0.0 (including), before 3.27.0.

Sonatype: Nexus Repository 3 versions up to and including 3.26.1.

NVD record Sonatype advisory

CVE-2021-29158 April 23, 2021 Medium 4.9 CVSS 3.1 4.9, rated by NVD yes yes 3.30.1 nearest fix; none on your branch
Sonatype Nexus Repository Manager 3 Pro up to and including 3.30.0 has Incorrect Access Control.

NVD configuration (NVD status: Analyzed): through 3.30.0.

Sonatype: Nexus Repository Manager 3 Pro versions up to and including 3.30.0.

NVD record Sonatype advisory

CVE-2026-10741 June 17, 2026 Medium 4.9 CVSS 3.1 4.9, rated by NVD yes yes 3.93.0 nearest fix; none on your branch
Sonatype Nexus Repository Manager before 3.93.0 contains an authorization vulnerability in the proxy repository configuration that allows a delegated repository administrator to disclose stored upstream proxy credentials.

NVD configuration (NVD status: Analyzed): from 3.1.0 (including), before 3.93.0.

Sonatype: All Sonatype Nexus Repository 3.x versions from 3.1.0 through 3.92.x.

NVD record Sonatype advisory

CVE-2026-17594 August 7, 2026 Medium 4.9 CVSS 3.1 4.9, rated by NVD yes yes 3.95.0 nearest fix; none on your branch
Nexus Repository 3 CE/Pro versions 3.0.0 through 3.94.x contain an incorrect authorization vulnerability (CWE-863) in the repository-creation user interface.

An individual user account holding a delegated repository-admin privilege scoped to a specific repository format could create a repository of a different, unauthorized format, because authorization was checked against one request field while a separate, attacker-controlled field determined the repository format actually created. This does not affect the anonymous user, which cannot hold this privilege by default. Fixed in version 3.95.0.

NVD configuration (NVD status: Analyzed): from 3.0.0 (including), before 3.95.0.

Sonatype: All previous Sonatype Nexus Repository 3 CE/Pro versions 3.0.0 through 3.94.x.

NVD record Sonatype advisory

CVE-2020-10203 April 1, 2020 Medium 4.8 CVSS 3.1 4.8, rated by NVD yes no Sonatype CNA range No Sonatype CNA range; NVD's range ends before 3.21.2. See Sonatype's advisory.
Sonatype Nexus Repository before 3.21.2 allows XSS.

NVD configuration (NVD status: Modified): before 3.21.2.

Sonatype publishes no affected range in the CVE record (assigned by MITRE).

NVD record Sonatype advisory

CVE-2021-34553 June 18, 2021 Medium 4.3 CVSS 3.1 4.3, rated by NVD yes yes 3.31.0 nearest fix; none on your branch
Sonatype Nexus Repository Manager 3.x before 3.31.0 allows a remote authenticated attacker to get a list of blob files and read the content of a blob file (via a GET request) without having been granted access.

NVD configuration (NVD status: Modified): from 3.0.0 (including), before 3.31.0.

Sonatype: Nexus Repository 3 versions up to and including 3.30.1.

NVD record Sonatype advisory

CVE-2021-42568 November 2, 2021 Medium 4.3 CVSS 3.1 4.3, rated by NVD yes no Sonatype CNA range No Sonatype CNA range; NVD's range runs through 3.35.0. See Sonatype's advisory.
Sonatype Nexus Repository Manager 3.x through 3.35.0 allows attackers to access the SSL Certificates Loading function via a low-privileged account.

NVD configuration (NVD status: Modified): from 3.0.0 (including), through 3.35.0.

Sonatype publishes no affected range in the CVE record (assigned by MITRE).

NVD record Sonatype advisory

CVE-2021-43293 November 4, 2021 Medium 4.3 CVSS 3.1 4.3, rated by NVD yes no Sonatype CNA range No Sonatype CNA range; NVD's range runs through 3.35.0. See Sonatype's advisory.
Sonatype Nexus Repository Manager 3.x before 3.36.0 allows a remote authenticated attacker to potentially perform network enumeration via Server Side Request Forgery (SSRF).

NVD configuration (NVD status: Modified): from 3.0.0 (including), through 3.35.0.

Sonatype publishes no affected range in the CVE record (assigned by MITRE).

NVD record Sonatype advisory

CVE-2021-43961 March 17, 2022 Medium 4.3 CVSS 3.1 4.3, rated by NVD yes yes 3.38.0 nearest fix; none on your branch
Sonatype Nexus Repository Manager 3.36.0 allows HTML Injection.

NVD configuration (NVD status: Modified): from 3.0.0 (including), before 3.38.0.

Sonatype: Nexus Repository 3 versions up to and including 3.37.3.

NVD record Sonatype advisory

CVE-2022-27907 March 30, 2022 Medium 4.3 CVSS 3.1 4.3, rated by NVD yes yes 3.38.0 nearest fix; none on your branch
Sonatype Nexus Repository Manager 3.x before 3.38.0 allows SSRF.

NVD configuration (NVD status: Modified): from 3.0.0 (including), before 3.38.0.

Sonatype: Nexus Repository 3 versions up to and including 3.37.3.

NVD record Sonatype advisory

CVE-2026-3048 May 11, 2026 Low 3.8 CVSS 3.1 3.8, rated by NVD yes yes 3.92.0 nearest fix; none on your branch
An authenticated administrator who configures or tests LDAP connectivity in Sonatype Nexus Repository Manager versions 3.0.0 through 3.91.1 may be able to initiate unintended server-side connections when interacting with a malicious LDAP server.

NVD configuration (NVD status: Analyzed): from 3.0.0 (including), before 3.92.0.

Sonatype: Sonatype Nexus Repository 3.0.0 through 3.91.x (CE/Pro).

NVD record Sonatype advisory

CVE-2026-17595 August 7, 2026 Low 2.7 CVSS 3.1 2.7, rated by NVD yes yes 3.95.0 nearest fix; none on your branch
Nexus Repository 3 did not fully sandbox JEXL expressions used in Content Selectors.

An account holding the nexus:selectors:create permission could construct an expression that read Java object properties not intended to be exposed to the expression engine, disclosing internal JVM class metadata such as class and classloader names. This issue does not permit method invocation, object construction, or arbitrary code execution. This has been fixed by restricting property access in the JEXL sandbox to the intended data types.

NVD configuration (NVD status: Analyzed): from 3.15.0 (including), before 3.95.0.

Sonatype: All previous Sonatype Nexus Repository 3 CE/Pro versions from 3.15.0 up to and including 3.94.x.

NVD record Sonatype advisory

CVE-2026-17597 August 7, 2026 Low 2.7 CVSS 3.1 2.7, rated by NVD yes yes 3.95.0 nearest fix; none on your branch
Nexus Repository 3 contains a Server-Side Request Forgery (SSRF) vulnerability in the email configuration verification feature.

A user holding the nexus:settings:update permission could submit arbitrary host and port values to the email test/verification endpoint, causing the server to attempt outbound network connections to internal or otherwise restricted network addresses. Differences in the server's response could be used to infer whether internal hosts and ports are reachable. This issue affects Nexus Repository 3 CE/Pro versions up to and including 3.94.1, and is fixed in version 3.95.0.

NVD configuration (NVD status: Analyzed): from 3.0.0 (including), before 3.95.0.

Sonatype: All previous Sonatype Nexus Repository 3 CE/Pro versions up to and including 3.94.x.

NVD record Sonatype advisory

24 other Sonatype Nexus Repository CVEs on record that do not affect 3.15.1

Each of these is fixed at or before 3.15.1 on its branch, or its published range does not include this version.

Sonatype Nexus Repository CVEs on record that do not affect 3.15.1
CVE Severity NVD Sonatype Fix
CVE-2019-7238 March 21, 2019 Critical 9.8 CVSS 3.1 9.8, rated by NVD no no Sonatype CNA range NVD's published range does not include this version.
Ranges and sources for CVE-2019-7238

NVD configuration (NVD status: Analyzed): from 3.0.0 (including), before 3.15.0.

Sonatype publishes no affected range in the CVE record (assigned by MITRE).

NVD record Sonatype advisory

CVE-2020-11753 April 20, 2020 High 8.8 CVSS 3.1 8.8, rated by NVD no no Predates the affected range (from 3.21.1).
Ranges and sources for CVE-2020-11753

NVD configuration (NVD status: Analyzed): exactly 3.21.1; exactly 3.22.0.

Sonatype: Nexus Repository 3 OSS/Pro versions 3.21.1 and 3.22.0.

NVD record Sonatype advisory

CVE-2026-17603 August 7, 2026 High 8.8 CVSS 3.1 8.8, rated by NVD no no Predates the affected range (from 3.20.0).
Ranges and sources for CVE-2026-17603

NVD configuration (NVD status: Analyzed): from 3.20.0 (including), before 3.95.0.

Sonatype: All Nexus Repository 3 CE/Pro versions from 3.20.0 up to and including 3.94.x.

NVD record Sonatype advisory

CVE-2026-3199 April 8, 2026 High 8.8 CVSS 3.1 8.8, rated by NVD no no Predates the affected range (from 3.22.1).
Ranges and sources for CVE-2026-3199

NVD configuration (NVD status: Analyzed): from 3.22.1 (including), before 3.91.0.

Sonatype: Sonatype Nexus Repository 3.22.1 through 3.90.x (CE/Pro).

NVD record Sonatype advisory

CVE-2018-16620 November 15, 2018 High 7.5 CVSS 3.0 7.5, rated by NVD no no Outside the affected range.
Ranges and sources for CVE-2018-16620

NVD configuration (NVD status: Modified): before 3.14.0.

Sonatype: All previous Nexus Repository 3 OSS/Pro versions up to and including 3.13.0.

NVD record Sonatype advisory

CVE-2018-16621 November 15, 2018 High 7.2 CVSS 3.1 7.2, rated by NVD no no Outside the affected range.
Ranges and sources for CVE-2018-16621

NVD configuration (NVD status: Modified): before 3.14.0.

Sonatype: All previous Nexus Repository 3 OSS/Pro versions up to and including 3.13.0.

NVD record Sonatype advisory

CVE-2026-14644 August 7, 2026 High 7.2 CVSS 3.1 7.2, rated by NVD no no Predates the affected range (from 3.19.0).
Ranges and sources for CVE-2026-14644

NVD configuration (NVD status: Analyzed): from 3.19.0 (including), before 3.95.0.

Sonatype: All previous Sonatype Nexus Repository 3 CE/Pro versions 3.19.0 through 3.94.x.

NVD record Sonatype advisory

CVE-2026-17599 August 7, 2026 High 7.2 CVSS 3.1 7.2, rated by NVD no no Predates the affected range (from 3.17.0).
Ranges and sources for CVE-2026-17599

NVD configuration (NVD status: Analyzed): from 3.17.0 (including), before 3.95.0.

Sonatype: All previous Nexus Repository 3 CE/Pro versions from 3.17.0 up to and including 3.94.x.

NVD record Sonatype advisory

CVE-2026-17601 August 7, 2026 High 7.2 CVSS 3.1 7.2, rated by NVD no no Predates the affected range (from 3.19.0).
Ranges and sources for CVE-2026-17601

NVD configuration (NVD status: Analyzed): from 3.19.0 (including), before 3.95.0.

Sonatype: All Sonatype Nexus Repository 3 CE/Pro versions from 3.19.0 through 3.94.x.

NVD record Sonatype advisory

CVE-2026-77124 September 2, 2026 High 7.2 CVSS 3.1 7.2, rated by NVD no no Predates the affected range (from 3.21.2).
Ranges and sources for CVE-2026-77124

NVD configuration (NVD status: Analyzed): from 3.21.2 (including), before 3.96.0.

Sonatype: All previous Sonatype Nexus Repository 3 CE/Pro versions from 3.21.2 up to and including 3.95.x.

NVD record Sonatype advisory

CVE-2026-77125 September 2, 2026 High 7.1 CVSS 3.1 7.1, rated by NVD no no Predates the affected range (from 3.19.0).
Ranges and sources for CVE-2026-77125

NVD configuration (NVD status: Analyzed): from 3.19.0 (including), before 3.96.0.

Sonatype: All Sonatype Nexus Repository 3 CE/Pro versions from 3.19.0 up to and including 3.95.x.

NVD record Sonatype advisory

CVE-2026-97665 October 15, 2026 High 7.1 CVSS 4.0 7.1, rated by Sonatype (CNA) no NVD data no Predates the affected range (from 3.95.0).
Ranges and sources for CVE-2026-97665

NVD has published no version configuration for this record (NVD status: Awaiting Analysis).

Sonatype: Nexus Repository 3 CE/Pro versions 3.95.0 through 3.96.x.

NVD record Sonatype advisory

CVE-2026-14504 July 14, 2026 Medium 6.5 CVSS 3.1 6.5, rated by NVD no no Predates the affected range (from 3.88.0).
Ranges and sources for CVE-2026-14504

NVD configuration (NVD status: Analyzed): from 3.88.0 (including), before 3.94.0.

Sonatype: All previous Sonatype Nexus Repository 3 CE/Pro versions with Terraform hosted repositories (3.88.0+), Swift hosted repositories (3.89.0+), or Conda hosted repositories (3.91.0+), up to and including 3.93.x.

NVD record Sonatype advisory

CVE-2026-77121 September 2, 2026 Medium 6.5 CVSS 3.1 6.5, rated by NVD no no Predates the affected range (from 3.26.0).
Ranges and sources for CVE-2026-77121

NVD configuration (NVD status: Analyzed): from 3.26.0 (including), before 3.95.0.

Sonatype: Nexus Repository 3 CE/Pro versions 3.26 through 3.94.x.

NVD record Sonatype advisory

CVE-2018-16619 November 15, 2018 Medium 6.1 CVSS 3.0 6.1, rated by NVD no no Outside the affected range.
Ranges and sources for CVE-2018-16619

NVD configuration (NVD status: Modified): before 3.14.0.

Sonatype: All previous Nexus Repository Manager 3 OSS/Pro versions up to and including 3.13.0.

NVD record Sonatype advisory

CVE-2018-5306 February 9, 2018 Medium 6.1 CVSS 3.0 6.1, rated by NVD no no Outside the affected range.
Ranges and sources for CVE-2018-5306

NVD configuration (NVD status: Modified): from 3.0 (including), before 3.8.

Sonatype: All previous 3.x Nexus Repository OSS/Pro versions up to and including 3.7.1.

NVD record Sonatype advisory

CVE-2021-29159 April 28, 2021 Medium 6.1 CVSS 3.1 6.1, rated by NVD no no Predates the affected range (from 3.23.0).
Ranges and sources for CVE-2021-29159

NVD configuration (NVD status: Modified): from 3.23.0 (including), before 3.30.1.

Sonatype: All Nexus Repository Manager 3 OSS/Pro versions between 3.23 and 3.30.

NVD record Sonatype advisory

CVE-2026-17596 August 7, 2026 Medium 6.1 CVSS 3.1 6.1, rated by NVD no no Predates the affected range (from 3.16.0).
Ranges and sources for CVE-2026-17596

NVD configuration (NVD status: Analyzed): from 3.16.0 (including), before 3.95.0.

Sonatype: Sonatype Nexus Repository 3 CE/Pro versions 3.16.0 through 3.94.x.

NVD record Sonatype advisory

CVE-2025-13488 December 4, 2025 Medium 5.1 CVSS 4.0 5.1, rated by Sonatype (CNA) no NVD data no Predates the affected range (from 3.83.0).
Ranges and sources for CVE-2025-13488

NVD has published no version configuration for this record (NVD status: Deferred).

Sonatype: Sonatype Nexus Repository 3.x CE/Pro versions 3.83.0 through 3.86.2.

NVD record Sonatype advisory

CVE-2026-0601 January 14, 2026 Medium 5.1 CVSS 4.0 5.1, rated by Sonatype (CNA) no NVD data no Predates the affected range (from 3.82.0).
Ranges and sources for CVE-2026-0601

NVD has published no version configuration for this record (NVD status: Deferred).

Sonatype: Sonatype Nexus Repository 3.82.0 through 3.87.1 (CE/Pro).

NVD record Sonatype advisory

CVE-2026-97667 October 15, 2026 Medium 5.1 CVSS 4.0 5.1, rated by Sonatype (CNA) no NVD data no Predates the affected range (from 3.28.0).
Ranges and sources for CVE-2026-97667

NVD has published no version configuration for this record (NVD status: Awaiting Analysis).

Sonatype: All Sonatype Nexus Repository 3 CE/Pro versions from 3.28.0 up to, but not including, 3.97.0.

NVD record Sonatype advisory

CVE-2026-17598 August 7, 2026 Medium 4.9 CVSS 3.1 4.9, rated by NVD no no Predates the affected range (from 3.91.0).
Ranges and sources for CVE-2026-17598

NVD configuration (NVD status: Analyzed): from 3.91.0 (including), before 3.95.0.

Sonatype: Sonatype Nexus Repository 3 CE/Pro versions 3.91.0 through 3.94.x.

NVD record Sonatype advisory

CVE-2018-12100 June 11, 2018 Medium 4.8 CVSS 3.0 4.8, rated by NVD no no Outside the affected range.
Ranges and sources for CVE-2018-12100

NVD configuration (NVD status: Modified): from 3.3.0 (including), before 3.12.0.

Sonatype: All previous Nexus Repository 3 OSS/Pro versions up to and including 3.11.0-01..

NVD record Sonatype advisory

CVE-2026-77122 September 2, 2026 Medium 4.3 CVSS 3.1 4.3, rated by NVD no no Predates the affected range (from 3.38.0).
Ranges and sources for CVE-2026-77122

NVD configuration (NVD status: Analyzed): from 3.38.0 (including), before 3.96.0.

Sonatype: All Sonatype Nexus Repository 3 CE/Pro versions from 3.38.0 up to (but not including) 3.96.0.

NVD record Sonatype advisory

Sources and method

NVD's count evaluates NVD's published version ranges against this version; those ranges do not carry Sonatype's per-branch fixes, so the NVD column can read the same on either side of a fix that Sonatype names. Where NVD has not analyzed a record, the row reads "no NVD data", not "no".

3.15.1 carries the same 46 known CVEs as 3 other Sonatype Nexus Repository releases: 3.15.0, 3.15.2, 3.15.3.

Sonatype's policy: Sonatype Nexus Repository releases are considered generally available and fully supported for a term of 1 year after the version's release date. Sonatype provides extended maintenance for each Sonatype Nexus Repository version for an additional 6 months before that version is considered sunset.

Sources: NVD (exact CPE match and the published configurations), the CVE Program record (the vendor's CNA entry with its affected and fixed versions), Sonatype's security advisories, release notes and end-of-life page. Pulled October 23, 2026. Every CVE row links to its NVD record and to the vendor's advisory.

Next