This vulnerability (CVE-2026-10748) in Sonatype Nexus Repository 3 (version 3.0.0) allows an authenticated user with the nx-licensing-create privilege to upload a specially crafted license file that triggers deserialization of untrusted data, enabling arbitrary operating system command execution under the Nexus process user context. The CVSS 4.0 base score is 8.6, indicating high severity with network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability. No official patch or remediation guidance has been provided by the vendor as of the publication date.

Successful exploitation allows an attacker with specific privileges to execute arbitrary OS commands as the Nexus process user, potentially leading to full compromise of the Nexus Repository server environment. This can result in unauthorized access, data manipulation, and service disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict the nx-licensing-create privilege to trusted users only and monitor for suspicious license file uploads. Avoid granting this privilege broadly.