Is CVE-2026-3199 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-3199 being exploited in the wild.

How severe is CVE-2026-3199?

Informational severity, with a CVSS score of 9.4, published 8 April 2026.

Which products and versions are affected?

Sonatype Nexus Repository 3.22.1 through 3.90.2.

Is there a fix for CVE-2026-3199?

A patch was published on 2026-04-08: Fixed in version 3.91.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-3199 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-3199?

Check whether you run Sonatype Nexus Repository at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-3199: Sonatype Nexus Repository RCE in task management component

CVE-2026-3199 · Severity: info · CVSS 9.4 · Published 2026-04-08

Sonatype Nexus Repository is a software platform used by organizations to store and manage their software components and dependencies. A security vulnerability in its task management system allows an authorized user with basic task-creation permissions to run unauthorized commands on the server. This could lead to a complete takeover of the repository, potentially allowing an attacker to steal proprietary code or disrupt software delivery pipelines.

Technologies: Sonatype Nexus Repository. Vendors: Sonatype.

Quick answers

Is CVE-2026-3199 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-3199 being exploited in the wild.
How severe is CVE-2026-3199?: Informational severity, with a CVSS score of 9.4, published 8 April 2026.
Which products and versions are affected?: Sonatype Nexus Repository 3.22.1 through 3.90.2.
Is there a fix for CVE-2026-3199?: A patch was published on 2026-04-08: Fixed in version 3.91.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-3199 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-3199?: Check whether you run Sonatype Nexus Repository at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A deserialization of untrusted data vulnerability (CWE-502) exists in the task management component of Sonatype Nexus Repository. Authenticated attackers with permissions to create tasks can exploit this flaw to bypass the 'nexus.scripts.allowCreation' security control, which is intended to restrict script execution. By submitting a specially crafted task, an attacker can achieve remote code execution (RCE) on the underlying server. The vulnerability affects versions 3.22.1 through 3.90.2 and is addressed in version 3.91.0.

Affected products

Sonatype Nexus Repository 3.22.1 through 3.90.2

Timeline

2026-04-08: disclosed
2026-04-08: advisory
2026-04-08: patched: Fixed in version 3.91.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.