CVE-2019-7238VulnerabilityPublished 12/10/2021Updated 10/24/2026

CVE-2019-7238: Sonatype Nexus Repository Manager Incorrect Access Control Vulnerability

Affects Sonatype Nexus Repository ManagerSource CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 12/10/2021
KEV deadline: 06/10/2022
EPSS: 76.6% chance of exploitation in 30 days – higher than 99% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2019-7238 (opens in a new tab)

Affected software

Product	Affected	Fixed in
Sonatype Nexus Repository Manager	Affected <3.15.0	Fixed in–

Description

CVE-2019-7238 is an incorrect access control vulnerability in Sonatype Nexus Repository Manager versions prior to 3.15.0. This flaw allows remote attackers to execute code on the affected system. The vulnerability has been exploited in the wild, indicating active threat usage. No explicit patch links or vendor advisory details are provided in the input data.

Summary

Sonatype Nexus Repository Manager before version 3.15.0 contains an incorrect access control vulnerability (CVE-2019-7238) that permits remote code execution. This vulnerability has been observed to be exploited in the wild, posing a significant risk to affected installations. The lack of explicit patch information in the provided data means remediation status is not confirmed here.

Impact

Exploitation of this vulnerability allows remote attackers to execute arbitrary code on the Nexus Repository Manager server, potentially leading to full system compromise. Given the known exploitation in the wild, this vulnerability represents a high risk to affected environments.

Mitigation

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is applied, restrict access to the Nexus Repository Manager instance to trusted networks and monitor for suspicious activity related to remote code execution attempts.

What to do

Affected software

Description

AnalysisAI-generated, updated 10/24/2026, 09:56:02 UTC

References

Related threats