CVE-2026-17596 is a stored cross-site scripting (CWE-79) vulnerability in Sonatype Nexus Repository 3. It allows an attacker with nexus:blobstores:create or nexus:blobstores:update permissions to inject malicious script code into a blob store name. This script executes when another user views the system health-check status page, potentially leading to script execution in the victim's browser. The issue affects versions from 3.16.0 up to but not including 3.95.0 and is fixed in 3.95.0.

An attacker with limited permissions can inject malicious scripts that execute in other users' browsers when they view the system health-check status. This could lead to typical XSS impacts such as session hijacking or unauthorized actions within the context of the affected application. The CVSS 4.0 score is 6.3 (medium severity), reflecting network attack vector, low attack complexity, and partial user interaction required.

Upgrade Sonatype Nexus Repository 3 to version 3.95.0 or later, where this vulnerability is fixed. No other official remediation or temporary workaround is indicated. Users should ensure that only trusted users have nexus:blobstores:create or nexus:blobstores:update permissions to reduce risk until patched.