Threats affecting pkg:maven/org.sonatype.nexus/nexus-repository-manager

CVE-2026-97665 is a high-severity vulnerability in Sonatype Nexus Repository 3 affecting the NuGet Components API upload path. It involves a missing authorization check that allows users with only read and browse privileges to upload and persist NuGet symbol packages (.snupkg) to a hosted repository, bypassing normal write-permission restrictions. This requires a hosted NuGet repository with Symbol Server enabled. If anonymous access is enabled, the anonymous user can exploit this without authentication due to default read and browse privileges.

An authenticated administrator who configures or tests LDAP connectivity in Sonatype Nexus Repository Manager versions 3.0.0 through 3.91.1 may be able to initiate unintended server-side connections when interacting with a malicious LDAP server.

CWE-798: Use of Hard-coded Credentials in Sonatype Nexus Repository Manager versions 3.0.0 through 3.70.5 allows an unauthenticated attacker with network access to gain unauthorized read/write access to the internal database and execute arbitrary OS commands as the Nexus process user. Exploitation requires the non-default nexus.orient.binaryListenerEnabled=true configuration to be enabled.

A vulnerability in the task management component of Sonatype Nexus Repository versions 3.22.1 through 3.90.2 allows an authenticated attacker with task creation permissions to execute arbitrary code, bypassing the nexus.scripts.allowCreation security control.