This vulnerability (CVE-2026-3329) in Sonatype Nexus Repository Manager 3.0.0 involves improper restriction of excessive authentication attempts (CWE-307), enabling remote unauthenticated attackers to conduct credential-guessing attacks against user accounts through authentication endpoints. The CVSS 4.0 base score is 8.7, indicating high severity, with attack vector network, no privileges or user interaction required, and high impact on confidentiality. The vendor has not published any patch or official remediation at this time.

Successful exploitation could allow attackers to guess user credentials remotely without authentication, potentially leading to unauthorized access to user accounts. This compromises confidentiality of user accounts but does not indicate impact on integrity or availability. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider implementing external rate limiting or monitoring on authentication endpoints to reduce the risk of credential-guessing attacks.