Is CVE-2026-77122 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-77122 being exploited in the wild.

How severe is CVE-2026-77122?

Medium severity, with a CVSS score of 4.3, published 2 September 2026.

Which products and versions are affected?

Sonatype Nexus Repository 3 3.0 through 3.96.2.

Is there a fix for CVE-2026-77122?

A patch was published on 2026-09-02: Fixed in version 3.96.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-77122 attacked?

It is attacked over the network.

Am I affected by CVE-2026-77122?

Check whether you run Sonatype Nexus Repository 3 or Sonatype Nexus Repository Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-77122: Sonatype Nexus Repository authorization bypass in REST API

CVE-2026-77122 · Severity: medium · CVSS 4.3 · Published 2026-09-02

Sonatype Nexus Repository is a software artifact repository manager used by organizations to store and manage build dependencies and application components. A flaw in its REST API allows users with read or browse permissions on a group repository to access metadata of private member repositories they shouldn't have access to, potentially exposing internal infrastructure hostnames and upstream server URLs. The vulnerability can be exploited by unauthenticated users if the anonymous user has been granted the necessary permissions.

Technologies: Sonatype Nexus Repository 3, Sonatype Nexus Repository Manager. Vendors: Sonatype.

Quick answers

Is CVE-2026-77122 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-77122 being exploited in the wild.
How severe is CVE-2026-77122?: Medium severity, with a CVSS score of 4.3, published 2 September 2026.
Which products and versions are affected?: Sonatype Nexus Repository 3 3.0 through 3.96.2.
Is there a fix for CVE-2026-77122?: A patch was published on 2026-09-02: Fixed in version 3.96.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-77122 attacked?: It is attacked over the network.
Am I affected by CVE-2026-77122?: Check whether you run Sonatype Nexus Repository 3 or Sonatype Nexus Repository Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is an authorization bypass vulnerability in the REST API endpoint GET /service/rest/v1/repositories/{repositoryName}. The vulnerable component fails to properly check permissions when responding to requests for repository details. An attacker with read or browse permissions on a group repository can query the endpoint directly for member repository names to retrieve metadata they should not access. For proxy repositories, this disclosure includes the configured remote URL, which may reveal internal upstream hostnames. The vulnerability affects Nexus Repository 3 and can be exploited unauthentically if the anonymous user holds group browse/read permissions. Patches are available in version 3.96.3 and later.

Affected products

Sonatype Nexus Repository 3 3.0 through 3.96.2

Timeline

2026-09-02: disclosed
2026-09-02: patched: Fixed in version 3.96.3

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.