CVE-2026-17600: Sonatype Nexus Repository 3 did not immediately terminate a user's active login session or revoke their cached…
CVE-2026-17600 · Severity: high · CVSS 8.8 · Published 2026-08-07
Sonatype Nexus Repository 3 did not immediately terminate a user's active login session or revoke their cached permissions when that user's account was deleted, deactivated, or had its password changed. A user whose account was already logged in at the time of one of these actions could continue using their existing session to interact with the repository as though the account were still active, until that session independently expired. Depending on the permissions previously held, this could allow continued unauthorized access to read, modify, or delete repository content after access was intended to be revoked.
No. Junglewise Threat Intelligence has no report of CVE-2026-17600 being exploited in the wild.
How severe is CVE-2026-17600?
High severity, with a CVSS score of 8.8, published 7 August 2026.
Which products and versions are affected?
Sonatype Nexus Repository Manager. The advisory does not name versions.
Is there a fix for CVE-2026-17600?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
Am I affected by CVE-2026-17600?
Check whether you run Sonatype Nexus Repository Manager. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.