© 2026 vulntracker.io

CVE-2026-77124

Nexus Repository 3 - Script Execution Disable Setting Not Enforced

HIGH

7.2

CVSS Score

Published: September 2, 2026 at 05:03 PM UTC

Updated: September 22, 2026 at 05:41 PM UTC

1 product affected across 1 vendorNexus Repository Manager

Using Nexus Repository 3 by Sonatype?

Get instant alerts when new vulnerabilities affect Nexus Repository 3 - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.2

Exploit prediction

EPSS 0.7%

SSVC

No known exploit

Description

In affected versions of Nexus Repository 3, the script execution endpoint (POST /service/rest/v1/script/{name}/run) did not verify whether script execution had been administratively disabled. An account holding script-execution permission could continue to run previously-created scripts even after an administrator set nexus.scripts.allowCreation=false, undermining the expectation that this setting fully blocks script execution.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Nexus Repository Manager · Sonatype

95%

3.21.2 ≤ v < 3.96.03.21.2 3.22.0 3.22.1 3.23.0 3.24.0 3.24.1 3.25.0 3.25.1 3.26.0 3.26.1 3.27.0 3.28.0 3.28.1 3.29.0 3.29.1 3.29.2 3.30.0 3.30.1 3.31.0 3.31.1 3.32.0 3.32.1 3.33.0 3.33.1 3.34.0 3.34.1 3.35.0 3.36.0 3.37.0 3.37.1 3.37.2 3.37.3 3.38.0 3.38.1 3.39.0 3.40.0 3.40.1 3.41.0 3.41.1 3.42.0 3.43.0 3.44.0 3.45.0 3.45.1 3.46.0 3.47.0 3.47.1 3.48.0 3.49.0 3.50.0 3.51.0 3.52.0 3.53.0 3.53.1 3.54.0 3.54.1 3.55.0 3.56.0 3.57.0 3.57.1 3.58.0 3.58.1 3.59.0 3.60.0 3.61.0 3.62.0 3.63.0 3.64.0 3.65.0 3.66.0 3.67.0 3.67.1 3.68.0 3.68.1 3.69.0 3.70.0 3.70.1 3.71.0 3.72.0 3.73.0 3.74.0 3.75.0 3.75.1 3.76.0 3.76.1 3.77.0 3.77.1 3.77.2 3.78.0 3.78.1 3.78.2 3.78.3 3.79.0 3.79.1 3.80.0 3.81.0 3.81.1 3.82.0 3.82.1 3.83.0 3.83.1 3.83.2 3.84.0 3.84.1 3.84.2 3.85.0 3.85.1 3.86.0 3.86.1 3.86.2 3.86.3 3.87.0 3.87.1 3.87.2 3.88.0 3.88.1 3.89.0 3.89.1 3.90.0 3.90.1 3.90.2 3.90.3 3.90.4 3.90.5 3.91.0 3.91.1 3.92.0 3.92.1 3.92.2 3.92.3 3.93.0 3.93.1 3.93.2 3.94.0 3.94.1 3.95.0 3.95.1 3.95.2 3.95.3

Affected range stops below 3.96.0, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

References (2)

PatchRelease Notes

Source: cverecord

https://help.sonatype.com/en/sonatype-nexus-repository-3-96-0-release-notes.html

Vendor AdvisoryMitigation

Source: cverecord

https://support.sonatype.com/hc/en-us/articles/54641528273811/

SSVC — Action Prioritization

SSVCNo known exploitNot automatableTotal impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

7.2HIGH[email protected]

Attack Vector: NETWORK
Complexity: LOW
Privileges: HIGH
User Interaction: NONE
Scope: UNCHANGED
Confidentiality: HIGH
Integrity: HIGH
Availability: HIGH

Vector?

Quick Info

StatusANALYZED

CWE

CWE-184

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create account Sign in

Free plan, no card