CyberSecBulletin
CVE-2026-77124NVD status: Analyzed

Nexus Repository 3: Incomplete List of Disallowed Inputs

Published Updated By the CyberSecBulletin desk

CVE-2026-77124 is a high-severity incomplete list of disallowed inputs vulnerability in Nexus Repository 3 from Sonatype, with a CVSS 3.1 base score of 7.2 out of 10. It can be exploited remotely over the network by an attacker with administrator privileges, without any action from a user. The record lists version 3.96.0 as the first without the flaw, so updating Nexus Repository 3 to that release or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.72% chance of exploitation within 30 days, higher than 55% of scored CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Nexus Repository 3 to 3.96.0 or a later version.
  2. Update Nexus Repository Manager to 3.96.0 or a later version.
  3. Read the advisory on support.sonatype.com for workarounds and exact fixed builds.

Affected products and versions

VendorProductAffected versionsFixed in
SonatypeNexus Repository 33.21.2 up to, but not including, 3.96.03.96.0
SonatypeNexus Repository Manager3.21.2 up to, but not including, 3.96.03.96.0

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
HighAdministrator-level access is required first.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. Scored by NVD.

Scoring systemScoreSeverityScored by
CVSS 4.07.5HighCNA
CVSS 3.17.2HighNVD

Official description

In affected versions of Nexus Repository 3, the script execution endpoint (POST /service/rest/v1/script/{name}/run) did not verify whether script execution had been administratively disabled. An account holding script-execution permission could continue to run previously-created scripts even after an administrator set nexus.scripts.allowCreation=false, undermining the expectation that this setting fully blocks script execution.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Incomplete List of Disallowed Inputs

The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.

How developers prevent this class of flaw

  • Do not rely exclusively on detecting disallowed inputs. There are too many variants to encode a character, especially when different environments are used, so there is a high likelihood of missing some variants. Only use detection of disallowed inputs as a mechanism for detecting suspicious activity. Ensure that you are using other protection mechanisms that only identify good input - such as lists of allowed inputs - and ensure that you are properly encoding your outputs.

More Incomplete List of Disallowed Inputs vulnerabilities (CWE-184)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Other vulnerabilities in Nexus Repository 3

All Nexus Repository 3 vulnerabilities

Recent Incomplete List of Disallowed Inputs vulnerabilities

Spotted an error? Tell us.