CVE-2026-77124 Nexus Repository 3 - Script Execution Disable Setting Not Enforced
Attackers with script permissions can execute scripts despite administrative disable settings, bypassing security controls in Nexus Repository 3.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-77124?
CVE-2026-77124 is a high-severity vulnerability in Sonatype Nexus Repository Manager, published on 2 Sep 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
In affected versions of Nexus Repository 3, the script execution endpoint (POST /service/rest/v1/script/{name}/run) did not verify whether script execution had been administratively disabled. An account holding script-execution permission could continue to run previously-created scripts even after an administrator set nexus.scripts.allowCreation=false, undermining the expectation that this setting fully blocks script execution.
Weakness: CWE-184
Which versions are affected by CVE-2026-77124?
It affects 1 product.
Products include Sonatype Nexus Repository Manager.
How do I fix CVE-2026-77124?
Apply the vendor's patch.
Is CVE-2026-77124 being exploited?
There is no known exploitation of CVE-2026-77124 in the wild and no public exploit code.
Other vulnerabilities in Sonatype Nexus Repository Manager
- CVE-2019-7238 Sonatype Nexus Repository Manager Incorrect Access Control
- CVE-2019-9629 Hardcoded credentials in n/a
- CVE-2017-17717 Hardcoded credentials in n/a
- CVE-2026-3199 Nexus Repository 3 - Authenticated Remote Code Execution via Task Property Injection
- CVE-2026-5189 Nexus Repository 3 - Hardcoded Credential in Internal Database Component
Sources
Also known as GHSA-jrwv-32cm-hj63, MINI-92p9-7v6g-f8h9, MINI-pc42-r8xg-wvr5.