Nexus 3.96.1 5 known CVEs

Support status: General Availability. General availability ends September 1, 2027. Sunset on March 1, 2028.

From Sonatype's published support dates.

Sonatype Nexus Repository 3.96.1
From Sonatype's release notes and support dates, and NVD
  1. Released September 12, 2026
  2. Support status General Availability
  3. General availability ends September 1, 2027
  4. Sunset on March 1, 2028
  5. Latest release 3.97.2, October 23, 2026
  6. Behind latest 41 days
  7. Lowest upgrade that fixes 4 of 5 3.97.0
  8. High 2 Medium 3
Known CVEs 5
The same 5 as 4 other releases, listed under the table

A lookup, not a scan of your server. All 5 come from Sonatype's advisories, which NVD has not analyzed. Pulled October 23, 2026. Sources and method

Tired of patching Nexus yourself?

This is what we do. We host your Maven, npm, PyPI and Docker repositories, so there's no Nexus server to upgrade or patch.

Our migration tool, free to use with CloudRepo, moves your hosted repositories over from Nexus 3 and checks every file.

Start free trial

14 days free. No credit card required.

Or book a call with Chris

Upgrade path

3.97.0 fixes 4 of these 5. For the 5th (CVE-2026-0600), Sonatype publishes a workaround, not a fix.

No known security breaches in our history.

The 5 CVEs that affect 3.96.1

Sorted by severity. A CVE counts when either NVD or Sonatype says this version is affected; both verdicts are shown. Latest release: 3.97.2.

CVEs that affect Sonatype Nexus Repository 3.96.1
CVE Severity NVD Sonatype Fix
CVE-2026-97712 October 15, 2026 High 8.7 CVSS 4.0 8.7, rated by Sonatype (CNA) no NVD data yes 3.97.0 nearest fix; none on your branch
Sonatype Nexus Repository 3 allows a user that holds the role create or role update permission to grant roles and privileges that the account does not hold.

This can give the user more access than intended, up to full administrative access.

NVD has published no version configuration for this record (NVD status: Awaiting Analysis).

Sonatype: All Sonatype Nexus Repository 3 CE/Pro versions from 3.0.0 up to and including 3.96.4.

NVD record Sonatype advisory

CVE-2026-97665 October 15, 2026 High 7.1 CVSS 4.0 7.1, rated by Sonatype (CNA) no NVD data yes 3.97.0 nearest fix; none on your branch
A missing authorization check in Nexus Repository 3's NuGet Components API upload path allows an account holding only repository read and browse privileges to upload and persist NuGet symbol packages (.snupkg) to a hosted repository, bypassing the write-permission check enforced for ordinary package uploads.

Exploitation requires a hosted NuGet repository with Symbol Server enabled. If anonymous access is enabled, the built-in anonymous user holds read and browse privileges across all repositories by default, so this precondition can also be met without an authenticated account.

NVD has published no version configuration for this record (NVD status: Awaiting Analysis).

Sonatype: Nexus Repository 3 CE/Pro versions 3.95.0 through 3.96.x.

NVD record Sonatype advisory

CVE-2026-97666 October 15, 2026 Medium 6.9 CVSS 4.0 6.9, rated by Sonatype (CNA) no NVD data yes 3.97.0 nearest fix; none on your branch
Sonatype Nexus Repository 3 allows an unauthenticated remote attacker to supply attacker-controlled input to a Java class loading call through an ExtDirect endpoint.

This allows the attacker to learn whether specific classes are present in the application. The issue does not by itself allow code execution.

NVD has published no version configuration for this record (NVD status: Awaiting Analysis).

Sonatype: All previous Sonatype Nexus Repository 3 CE/Pro versions up to and including 3.96.x.

NVD record Sonatype advisory

CVE-2026-0600 January 14, 2026 Medium 6.2 CVSS 4.0 6.2, rated by Sonatype (CNA) no NVD data yes No fixed version. Sonatype names a workaround from Sonatype Nexus Repository 3.88.0 (CE/Pro).
Server-Side Request Forgery (SSRF) vulnerability in Sonatype Nexus Repository 3 versions 3.0.0 and later allows authenticated administrators to configure proxy repositories with URLs that can access unintended network destinations, potentially including cloud metadata services and internal network resources.

A workaround configuration is available starting in version 3.88.0, but the product remains vulnerable by default.

NVD has published no version configuration for this record (NVD status: Deferred).

Sonatype: Sonatype Nexus Repository 3.0.0 and later (CE/Pro).

NVD record Sonatype advisory

CVE-2026-97667 October 15, 2026 Medium 5.1 CVSS 4.0 5.1, rated by Sonatype (CNA) no NVD data yes 3.97.0 nearest fix; none on your branch
Sonatype Nexus Repository 3 allows a user account that holds the edit permission on a hosted R repository to store script content in the metadata of an uploaded R package.

The script runs in the browser of a user who opens the details of that package in the Browse user interface, with the permissions of the viewing user. In this description, a user account means an account that has supplied valid credentials. The anonymous user, if enabled, is also a user account and can hold this permission if an administrator grants it.

NVD has published no version configuration for this record (NVD status: Awaiting Analysis).

Sonatype: All Sonatype Nexus Repository 3 CE/Pro versions from 3.28.0 up to, but not including, 3.97.0.

NVD record Sonatype advisory

65 other Sonatype Nexus Repository CVEs on record that do not affect 3.96.1

Each of these is fixed at or before 3.96.1 on its branch, or its published range does not include this version.

Sonatype Nexus Repository CVEs on record that do not affect 3.96.1
CVE Severity NVD Sonatype Fix
CVE-2019-7238 March 21, 2019 Critical 9.8 CVSS 3.1 9.8, rated by NVD no no Sonatype CNA range NVD's published range does not include this version.
Ranges and sources for CVE-2019-7238

NVD configuration (NVD status: Analyzed): from 3.0.0 (including), before 3.15.0.

Sonatype publishes no affected range in the CVE record (assigned by MITRE).

NVD record Sonatype advisory

CVE-2019-9629 July 8, 2019 Critical 9.8 CVSS 3.0 9.8, rated by NVD no no Sonatype CNA range NVD's published range does not include this version.
Ranges and sources for CVE-2019-9629

NVD configuration (NVD status: Modified): before 3.17.0.

Sonatype publishes no affected range in the CVE record (assigned by MITRE).

NVD record Sonatype advisory

CVE-2026-5189 April 15, 2026 Critical 9.8 CVSS 3.1 9.8, rated by NVD no no Outside the affected range.
Ranges and sources for CVE-2026-5189

NVD configuration (NVD status: Analyzed): from 3.0.0 (including), before 3.71.0.

Sonatype: All Sonatype Nexus Repository 3.x CE/Pro versions 3.0.0 through 3.70.5.

NVD record Sonatype advisory

CVE-2020-10199 April 1, 2020 High 8.8 CVSS 3.1 8.8, rated by NVD no no Outside the affected range.
Ranges and sources for CVE-2020-10199

NVD configuration (NVD status: Analyzed): before 3.21.2.

Sonatype: All previous Nexus Repository 3.x OSS/Pro versions up to and including 3.21.1.

NVD record Sonatype advisory

CVE-2020-11444 April 2, 2020 High 8.8 CVSS 3.1 8.8, rated by NVD no no Outside the affected range.
Ranges and sources for CVE-2020-11444

NVD configuration (NVD status: Modified): from 3.0.0 (including), through 3.21.2.

Sonatype: All previous Nexus Repository 3 OSS/Pro versions up to and including 3.21.2.

NVD record Sonatype advisory

CVE-2020-11753 April 20, 2020 High 8.8 CVSS 3.1 8.8, rated by NVD no no Outside the affected range.
Ranges and sources for CVE-2020-11753

NVD configuration (NVD status: Analyzed): exactly 3.21.1; exactly 3.22.0.

Sonatype: Nexus Repository 3 OSS/Pro versions 3.21.1 and 3.22.0.

NVD record Sonatype advisory

CVE-2020-15871 July 31, 2020 High 8.8 CVSS 3.1 8.8, rated by NVD no no Sonatype CNA range NVD's published range does not include this version.
Ranges and sources for CVE-2020-15871

NVD configuration (NVD status: Analyzed): before 3.25.1.

Sonatype publishes no affected range in the CVE record (assigned by MITRE).

NVD record Sonatype advisory

CVE-2026-17600 August 7, 2026 High 8.8 CVSS 3.1 8.8, rated by NVD no no Outside the affected range.
Ranges and sources for CVE-2026-17600

NVD configuration (NVD status: Analyzed): from 3.0.0 (including), before 3.95.0.

Sonatype: All Sonatype Nexus Repository CE/Pro versions prior to 3.95.0.

NVD record Sonatype advisory

CVE-2026-17603 August 7, 2026 High 8.8 CVSS 3.1 8.8, rated by NVD no no Outside the affected range.
Ranges and sources for CVE-2026-17603

NVD configuration (NVD status: Analyzed): from 3.20.0 (including), before 3.95.0.

Sonatype: All Nexus Repository 3 CE/Pro versions from 3.20.0 up to and including 3.94.x.

NVD record Sonatype advisory

CVE-2026-3199 April 8, 2026 High 8.8 CVSS 3.1 8.8, rated by NVD no no Outside the affected range.
Ranges and sources for CVE-2026-3199

NVD configuration (NVD status: Analyzed): from 3.22.1 (including), before 3.91.0.

Sonatype: Sonatype Nexus Repository 3.22.1 through 3.90.x (CE/Pro).

NVD record Sonatype advisory

CVE-2021-40143 September 7, 2021 High 8.2 CVSS 3.1 8.2, rated by NVD no no Outside the affected range.
Ranges and sources for CVE-2021-40143

NVD configuration (NVD status: Analyzed): from 3.0.0 (including), before 3.34.1-01.

Sonatype: Nexus Repository 3 versions up to and including 3.33.1.

NVD record Sonatype advisory

CVE-2026-14646 July 14, 2026 High 7.7 CVSS 3.1 7.7, rated by NVD no no Outside the affected range.
Ranges and sources for CVE-2026-14646

NVD configuration (NVD status: Analyzed): from 3.0.0 (including), before 3.94.0.

Sonatype: All Sonatype Nexus Repository 3 CE/Pro versions from 3.0.0 up to and including 3.93.x.

NVD record Sonatype advisory

CVE-2018-16620 November 15, 2018 High 7.5 CVSS 3.0 7.5, rated by NVD no no Outside the affected range.
Ranges and sources for CVE-2018-16620

NVD configuration (NVD status: Modified): before 3.14.0.

Sonatype: All previous Nexus Repository 3 OSS/Pro versions up to and including 3.13.0.

NVD record Sonatype advisory

CVE-2019-9630 July 8, 2019 High 7.5 CVSS 3.0 7.5, rated by NVD no no Sonatype CNA range NVD's published range does not include this version.
Ranges and sources for CVE-2019-9630

NVD configuration (NVD status: Modified): before 3.17.0.

Sonatype publishes no affected range in the CVE record (assigned by MITRE).

NVD record Sonatype advisory

CVE-2020-15868 August 12, 2020 High 7.5 CVSS 3.1 7.5, rated by NVD no no Sonatype CNA range NVD's published range does not include this version.
Ranges and sources for CVE-2020-15868

NVD configuration (NVD status: Modified): before 3.26.0.

Sonatype publishes no affected range in the CVE record (assigned by MITRE).

NVD record Sonatype advisory

CVE-2024-4956 May 16, 2024 High 7.5 CVSS 3.1 7.5, rated by Sonatype (CNA) no NVD data no Outside the affected range.
Ranges and sources for CVE-2024-4956

NVD has published no version configuration for this record (NVD status: Deferred).

Sonatype: All previous Sonatype Nexus Repository 3.x OSS/Pro versions up to and including 3.68.0.

NVD record Sonatype advisory

CVE-2026-11403 July 14, 2026 High 7.5 CVSS 3.1 7.5, rated by NVD no no Outside the affected range.
Ranges and sources for CVE-2026-11403

NVD configuration (NVD status: Analyzed): from 3.0.0 (including), before 3.93.0.

Sonatype: All Sonatype Nexus Repository 3.x CE/Pro versions before 3.93.0.

NVD record Sonatype advisory

CVE-2026-3329 June 11, 2026 High 7.5 CVSS 3.1 7.5, rated by NVD no no Outside the affected range.
Ranges and sources for CVE-2026-3329

NVD configuration (NVD status: Analyzed): from 3.0.0 (including), before 3.93.0.

Sonatype: All Sonatype Nexus Repository versions from 3.0.0 up to and including 3.92.x.

NVD record Sonatype advisory

CVE-2018-16621 November 15, 2018 High 7.2 CVSS 3.1 7.2, rated by NVD no no Outside the affected range.
Ranges and sources for CVE-2018-16621

NVD configuration (NVD status: Modified): before 3.14.0.

Sonatype: All previous Nexus Repository 3 OSS/Pro versions up to and including 3.13.0.

NVD record Sonatype advisory

CVE-2019-16530 October 21, 2019 High 7.2 CVSS 3.1 7.2, rated by NVD no no Outside the affected range.
Ranges and sources for CVE-2019-16530

NVD configuration (NVD status: Modified): from 2.0.0 (including), through 2.14.14; from 3.0.0 (including), through 3.18.1.

Sonatype: Nexus Repository 2 versions up to and including 2.14.14; Nexus Repository 3 versions up to and including 3.18.1; IQ Server versions up to and including 72.

NVD record Sonatype advisory

CVE-2020-10204 April 1, 2020 High 7.2 CVSS 3.1 7.2, rated by NVD no no Sonatype CNA range NVD's published range does not include this version.
Ranges and sources for CVE-2020-10204

NVD configuration (NVD status: Modified): before 3.21.2.

Sonatype publishes no affected range in the CVE record (assigned by MITRE).

NVD record Sonatype advisory

CVE-2026-10748 June 16, 2026 High 7.2 CVSS 3.1 7.2, rated by NVD no no Outside the affected range.
Ranges and sources for CVE-2026-10748

NVD configuration (NVD status: Analyzed): from 3.0.0 (including), before 3.92.0.

Sonatype: All Sonatype Nexus Repository 3.x CE/Pro versions before 3.92.0.

NVD record Sonatype advisory

CVE-2026-14644 August 7, 2026 High 7.2 CVSS 3.1 7.2, rated by NVD no no Outside the affected range.
Ranges and sources for CVE-2026-14644

NVD configuration (NVD status: Analyzed): from 3.19.0 (including), before 3.95.0.

Sonatype: All previous Sonatype Nexus Repository 3 CE/Pro versions 3.19.0 through 3.94.x.

NVD record Sonatype advisory

CVE-2026-17593 August 7, 2026 High 7.2 CVSS 3.1 7.2, rated by NVD no no Outside the affected range.
Ranges and sources for CVE-2026-17593

NVD configuration (NVD status: Analyzed): from 2.8.0 (including), before 3.95.0.

Sonatype: All previous Sonatype Nexus Repository CE/Pro versions from 2.8.0 up to and including 3.94.x.

NVD record Sonatype advisory

CVE-2026-17599 August 7, 2026 High 7.2 CVSS 3.1 7.2, rated by NVD no no Outside the affected range.
Ranges and sources for CVE-2026-17599

NVD configuration (NVD status: Analyzed): from 3.17.0 (including), before 3.95.0.

Sonatype: All previous Nexus Repository 3 CE/Pro versions from 3.17.0 up to and including 3.94.x.

NVD record Sonatype advisory

CVE-2026-17601 August 7, 2026 High 7.2 CVSS 3.1 7.2, rated by NVD no no Outside the affected range.
Ranges and sources for CVE-2026-17601

NVD configuration (NVD status: Analyzed): from 3.19.0 (including), before 3.95.0.

Sonatype: All Sonatype Nexus Repository 3 CE/Pro versions from 3.19.0 through 3.94.x.

NVD record Sonatype advisory

CVE-2026-77124 September 2, 2026 High 7.2 CVSS 3.1 7.2, rated by NVD no no 3.96.0 already fixed in this version
Ranges and sources for CVE-2026-77124

NVD configuration (NVD status: Analyzed): from 3.21.2 (including), before 3.96.0.

Sonatype: All previous Sonatype Nexus Repository 3 CE/Pro versions from 3.21.2 up to and including 3.95.x.

NVD record Sonatype advisory

CVE-2026-77125 September 2, 2026 High 7.1 CVSS 3.1 7.1, rated by NVD no no 3.96.0 already fixed in this version
Ranges and sources for CVE-2026-77125

NVD configuration (NVD status: Analyzed): from 3.19.0 (including), before 3.96.0.

Sonatype: All Sonatype Nexus Repository 3 CE/Pro versions from 3.19.0 up to and including 3.95.x.

NVD record Sonatype advisory

CVE-2020-29436 December 17, 2020 Medium 6.5 CVSS 3.1 6.5, rated by NVD no no Sonatype CNA range NVD's published range does not include this version.
Ranges and sources for CVE-2020-29436

NVD configuration (NVD status: Modified): from 3.0.0 (including), before 3.29.0.

Sonatype publishes no affected range in the CVE record (assigned by MITRE).

NVD record Sonatype advisory

CVE-2024-5764 October 23, 2024 Medium 6.5 CVSS 3.1 6.5, rated by NVD no no Outside the affected range.
Ranges and sources for CVE-2024-5764

NVD configuration (NVD status: Analyzed): from 3.0.0 (including), before 3.73.0.

Sonatype: All previous Sonatype Nexus Repository Manager 3.x OSS/Pro versions up to and including 3.72.0.

NVD record Sonatype advisory

CVE-2026-14504 July 14, 2026 Medium 6.5 CVSS 3.1 6.5, rated by NVD no no Outside the affected range.
Ranges and sources for CVE-2026-14504

NVD configuration (NVD status: Analyzed): from 3.88.0 (including), before 3.94.0.

Sonatype: All previous Sonatype Nexus Repository 3 CE/Pro versions with Terraform hosted repositories (3.88.0+), Swift hosted repositories (3.89.0+), or Conda hosted repositories (3.91.0+), up to and including 3.93.x.

NVD record Sonatype advisory

CVE-2026-77121 September 2, 2026 Medium 6.5 CVSS 3.1 6.5, rated by NVD no no Outside the affected range.
Ranges and sources for CVE-2026-77121

NVD configuration (NVD status: Analyzed): from 3.26.0 (including), before 3.95.0.

Sonatype: Nexus Repository 3 CE/Pro versions 3.26 through 3.94.x.

NVD record Sonatype advisory

CVE-2026-77123 September 2, 2026 Medium 6.5 CVSS 3.1 6.5, rated by NVD no no 3.96.0 already fixed in this version
Ranges and sources for CVE-2026-77123

NVD configuration (NVD status: Analyzed): from 3.2.0 (including), before 3.96.0.

Sonatype: All Sonatype Nexus Repository 3 CE/Pro versions from 3.2.0 up to and including 3.95.x.

NVD record Sonatype advisory

CVE-2018-16619 November 15, 2018 Medium 6.1 CVSS 3.0 6.1, rated by NVD no no Outside the affected range.
Ranges and sources for CVE-2018-16619

NVD configuration (NVD status: Modified): before 3.14.0.

Sonatype: All previous Nexus Repository Manager 3 OSS/Pro versions up to and including 3.13.0.

NVD record Sonatype advisory

CVE-2018-5306 February 9, 2018 Medium 6.1 CVSS 3.0 6.1, rated by NVD no no Outside the affected range.
Ranges and sources for CVE-2018-5306

NVD configuration (NVD status: Modified): from 3.0 (including), before 3.8.

Sonatype: All previous 3.x Nexus Repository OSS/Pro versions up to and including 3.7.1.

NVD record Sonatype advisory

CVE-2020-15870 July 31, 2020 Medium 6.1 CVSS 3.1 6.1, rated by NVD no no Outside the affected range.
Ranges and sources for CVE-2020-15870

NVD configuration (NVD status: Analyzed): before 3.25.1.

Sonatype: All previous Nexus Repository 3 OSS/Pro versions up to and including 3.25.0.

NVD record Sonatype advisory

CVE-2021-29159 April 28, 2021 Medium 6.1 CVSS 3.1 6.1, rated by NVD no no Outside the affected range.
Ranges and sources for CVE-2021-29159

NVD configuration (NVD status: Modified): from 3.23.0 (including), before 3.30.1.

Sonatype: All Nexus Repository Manager 3 OSS/Pro versions between 3.23 and 3.30.

NVD record Sonatype advisory

CVE-2026-17596 August 7, 2026 Medium 6.1 CVSS 3.1 6.1, rated by NVD no no Outside the affected range.
Ranges and sources for CVE-2026-17596

NVD configuration (NVD status: Analyzed): from 3.16.0 (including), before 3.95.0.

Sonatype: Sonatype Nexus Repository 3 CE/Pro versions 3.16.0 through 3.94.x.

NVD record Sonatype advisory

CVE-2026-3438 April 8, 2026 Medium 6.1 CVSS 3.1 6.1, rated by NVD no no Outside the affected range.
Ranges and sources for CVE-2026-3438

NVD configuration (NVD status: Analyzed): from 3.0.0 (including), before 3.91.0.

Sonatype: All Sonatype Nexus Repository 3.x CE/Pro versions up to and including 3.90.x.

NVD record Sonatype advisory

CVE-2026-14645 July 14, 2026 Medium 5.5 CVSS 3.1 5.5, rated by NVD no no Outside the affected range.
Ranges and sources for CVE-2026-14645

NVD configuration (NVD status: Analyzed): from 3.0.0 (including), before 3.94.0.

Sonatype: All previous Sonatype Nexus Repository 3 CE/Pro versions up to and including 3.93.x.

NVD record Sonatype advisory

CVE-2019-14469 August 22, 2019 Medium 5.4 CVSS 3.0 5.4, rated by NVD no no Outside the affected range.
Ranges and sources for CVE-2019-14469

NVD configuration (NVD status: Modified): from 3.14.0 (including), through 3.17.0.

Sonatype: Nexus Repository 3 versions starting in 3.14.0 up to and including 3.17.0.

NVD record Sonatype advisory

CVE-2020-15869 July 31, 2020 Medium 5.4 CVSS 3.1 5.4, rated by NVD no no Outside the affected range.
Ranges and sources for CVE-2020-15869

NVD configuration (NVD status: Analyzed): before 3.25.1.

Sonatype: All previous Nexus Repository Manager 3 OSS/Pro versions up to and including 3.25.0.

NVD record Sonatype advisory

CVE-2021-37152 August 10, 2021 Medium 5.4 CVSS 3.1 5.4, rated by NVD no no Outside the affected range.
Ranges and sources for CVE-2021-37152

NVD configuration (NVD status: Modified): from 3.0.0 (including), before 3.33.0.

Sonatype: Nexus Repository 3 versions up to and including 3.32.0.

NVD record Sonatype advisory

CVE-2026-7308 May 11, 2026 Medium 5.4 CVSS 3.1 5.4, rated by NVD no no Outside the affected range.
Ranges and sources for CVE-2026-7308

NVD configuration (NVD status: Analyzed): from 3.6.0 (including), before 3.93.0.

Sonatype: Sonatype Nexus Repository 3.6.0 through 3.91.x (CE/Pro).

NVD record Sonatype advisory

CVE-2021-30635 April 27, 2021 Medium 5.3 CVSS 3.1 5.3, rated by NVD no no Outside the affected range.
Ranges and sources for CVE-2021-30635

NVD configuration (NVD status: Modified): from 3.0 (including), before 3.30.1.

Sonatype: Nexus Repository Manager 3 versions up to and including 3.30.0.

NVD record Sonatype advisory

CVE-2025-13488 December 4, 2025 Medium 5.1 CVSS 4.0 5.1, rated by Sonatype (CNA) no NVD data no Outside the affected range.
Ranges and sources for CVE-2025-13488

NVD has published no version configuration for this record (NVD status: Deferred).

Sonatype: Sonatype Nexus Repository 3.x CE/Pro versions 3.83.0 through 3.86.2.

NVD record Sonatype advisory

CVE-2026-0601 January 14, 2026 Medium 5.1 CVSS 4.0 5.1, rated by Sonatype (CNA) no NVD data no Outside the affected range.
Ranges and sources for CVE-2026-0601

NVD has published no version configuration for this record (NVD status: Deferred).

Sonatype: Sonatype Nexus Repository 3.82.0 through 3.87.1 (CE/Pro).

NVD record Sonatype advisory

CVE-2026-7494 July 14, 2026 Medium 5.0 CVSS 3.1 5.0, rated by NVD no no Outside the affected range.
Ranges and sources for CVE-2026-7494

NVD configuration (NVD status: Analyzed): from 3.0.0 (including), before 3.94.0.

Sonatype: Sonatype Nexus Repository 3 CE/Pro versions 3.0.0 up to and including 3.93.x.

NVD record Sonatype advisory

CVE-2020-11415 April 27, 2020 Medium 4.9 CVSS 3.1 4.9, rated by NVD no no Sonatype CNA range NVD's published range does not include this version.
Ranges and sources for CVE-2020-11415

NVD configuration (NVD status: Modified): from 2.0 (including), before 2.14.17; from 3.0 (including), before 3.22.1.

Sonatype publishes no affected range in the CVE record (assigned by MITRE).

NVD record Sonatype advisory

CVE-2020-24622 August 25, 2020 Medium 4.9 CVSS 3.1 4.9, rated by NVD no no Outside the affected range.
Ranges and sources for CVE-2020-24622

NVD configuration (NVD status: Modified): from 3.0.0 (including), before 3.27.0.

Sonatype: Nexus Repository 3 versions up to and including 3.26.1.

NVD record Sonatype advisory

CVE-2021-29158 April 23, 2021 Medium 4.9 CVSS 3.1 4.9, rated by NVD no no Outside the affected range.
Ranges and sources for CVE-2021-29158

NVD configuration (NVD status: Analyzed): through 3.30.0.

Sonatype: Nexus Repository Manager 3 Pro versions up to and including 3.30.0.

NVD record Sonatype advisory

CVE-2026-10741 June 17, 2026 Medium 4.9 CVSS 3.1 4.9, rated by NVD no no Outside the affected range.
Ranges and sources for CVE-2026-10741

NVD configuration (NVD status: Analyzed): from 3.1.0 (including), before 3.93.0.

Sonatype: All Sonatype Nexus Repository 3.x versions from 3.1.0 through 3.92.x.

NVD record Sonatype advisory

CVE-2026-17594 August 7, 2026 Medium 4.9 CVSS 3.1 4.9, rated by NVD no no Outside the affected range.
Ranges and sources for CVE-2026-17594

NVD configuration (NVD status: Analyzed): from 3.0.0 (including), before 3.95.0.

Sonatype: All previous Sonatype Nexus Repository 3 CE/Pro versions 3.0.0 through 3.94.x.

NVD record Sonatype advisory

CVE-2026-17598 August 7, 2026 Medium 4.9 CVSS 3.1 4.9, rated by NVD no no Outside the affected range.
Ranges and sources for CVE-2026-17598

NVD configuration (NVD status: Analyzed): from 3.91.0 (including), before 3.95.0.

Sonatype: Sonatype Nexus Repository 3 CE/Pro versions 3.91.0 through 3.94.x.

NVD record Sonatype advisory

CVE-2018-12100 June 11, 2018 Medium 4.8 CVSS 3.0 4.8, rated by NVD no no Outside the affected range.
Ranges and sources for CVE-2018-12100

NVD configuration (NVD status: Modified): from 3.3.0 (including), before 3.12.0.

Sonatype: All previous Nexus Repository 3 OSS/Pro versions up to and including 3.11.0-01..

NVD record Sonatype advisory

CVE-2020-10203 April 1, 2020 Medium 4.8 CVSS 3.1 4.8, rated by NVD no no Sonatype CNA range NVD's published range does not include this version.
Ranges and sources for CVE-2020-10203

NVD configuration (NVD status: Modified): before 3.21.2.

Sonatype publishes no affected range in the CVE record (assigned by MITRE).

NVD record Sonatype advisory

CVE-2021-34553 June 18, 2021 Medium 4.3 CVSS 3.1 4.3, rated by NVD no no Outside the affected range.
Ranges and sources for CVE-2021-34553

NVD configuration (NVD status: Modified): from 3.0.0 (including), before 3.31.0.

Sonatype: Nexus Repository 3 versions up to and including 3.30.1.

NVD record Sonatype advisory

CVE-2021-42568 November 2, 2021 Medium 4.3 CVSS 3.1 4.3, rated by NVD no no Sonatype CNA range NVD's published range does not include this version.
Ranges and sources for CVE-2021-42568

NVD configuration (NVD status: Modified): from 3.0.0 (including), through 3.35.0.

Sonatype publishes no affected range in the CVE record (assigned by MITRE).

NVD record Sonatype advisory

CVE-2021-43293 November 4, 2021 Medium 4.3 CVSS 3.1 4.3, rated by NVD no no Sonatype CNA range NVD's published range does not include this version.
Ranges and sources for CVE-2021-43293

NVD configuration (NVD status: Modified): from 3.0.0 (including), through 3.35.0.

Sonatype publishes no affected range in the CVE record (assigned by MITRE).

NVD record Sonatype advisory

CVE-2021-43961 March 17, 2022 Medium 4.3 CVSS 3.1 4.3, rated by NVD no no Outside the affected range.
Ranges and sources for CVE-2021-43961

NVD configuration (NVD status: Modified): from 3.0.0 (including), before 3.38.0.

Sonatype: Nexus Repository 3 versions up to and including 3.37.3.

NVD record Sonatype advisory

CVE-2022-27907 March 30, 2022 Medium 4.3 CVSS 3.1 4.3, rated by NVD no no Outside the affected range.
Ranges and sources for CVE-2022-27907

NVD configuration (NVD status: Modified): from 3.0.0 (including), before 3.38.0.

Sonatype: Nexus Repository 3 versions up to and including 3.37.3.

NVD record Sonatype advisory

CVE-2026-77122 September 2, 2026 Medium 4.3 CVSS 3.1 4.3, rated by NVD no no 3.96.0 already fixed in this version
Ranges and sources for CVE-2026-77122

NVD configuration (NVD status: Analyzed): from 3.38.0 (including), before 3.96.0.

Sonatype: All Sonatype Nexus Repository 3 CE/Pro versions from 3.38.0 up to (but not including) 3.96.0.

NVD record Sonatype advisory

CVE-2026-3048 May 11, 2026 Low 3.8 CVSS 3.1 3.8, rated by NVD no no Outside the affected range.
Ranges and sources for CVE-2026-3048

NVD configuration (NVD status: Analyzed): from 3.0.0 (including), before 3.92.0.

Sonatype: Sonatype Nexus Repository 3.0.0 through 3.91.x (CE/Pro).

NVD record Sonatype advisory

CVE-2026-17595 August 7, 2026 Low 2.7 CVSS 3.1 2.7, rated by NVD no no Outside the affected range.
Ranges and sources for CVE-2026-17595

NVD configuration (NVD status: Analyzed): from 3.15.0 (including), before 3.95.0.

Sonatype: All previous Sonatype Nexus Repository 3 CE/Pro versions from 3.15.0 up to and including 3.94.x.

NVD record Sonatype advisory

CVE-2026-17597 August 7, 2026 Low 2.7 CVSS 3.1 2.7, rated by NVD no no Outside the affected range.
Ranges and sources for CVE-2026-17597

NVD configuration (NVD status: Analyzed): from 3.0.0 (including), before 3.95.0.

Sonatype: All previous Sonatype Nexus Repository 3 CE/Pro versions up to and including 3.94.x.

NVD record Sonatype advisory

Sources and method

NVD's count evaluates NVD's published version ranges against this version; those ranges do not carry Sonatype's per-branch fixes, so the NVD column can read the same on either side of a fix that Sonatype names. Where NVD has not analyzed a record, the row reads "no NVD data", not "no".

3.96.1 carries the same 5 known CVEs as 4 other Sonatype Nexus Repository releases: 3.96.0, 3.96.2, 3.96.3, 3.96.4.

Sonatype's policy: Sonatype Nexus Repository releases are considered generally available and fully supported for a term of 1 year after the version's release date. Sonatype provides extended maintenance for each Sonatype Nexus Repository version for an additional 6 months before that version is considered sunset.

Sources: NVD (exact CPE match and the published configurations), the CVE Program record (the vendor's CNA entry with its affected and fixed versions), Sonatype's security advisories, release notes and end-of-life page. Pulled October 23, 2026. Every CVE row links to its NVD record and to the vendor's advisory.

Next