Is CVE-2026-77124 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-77124 being exploited in the wild.

How severe is CVE-2026-77124?

High severity, with a CVSS score of 7.2, published 2 September 2026.

Which products and versions are affected?

Sonatype Nexus Repository 3 (prior to 3.96.0).

Is there a fix for CVE-2026-77124?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-77124 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-77124?

Check whether you run Sonatype Nexus Repository or Sonatype Nexus Repository Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-77124: Sonatype Nexus Repository privilege escalation in script execution

CVE-2026-77124 · Severity: high · CVSS 7.2 · Published 2026-09-02

Nexus Repository is a widely-used software component management system that allows organizations to manage and store software artifacts. A flaw in the script execution endpoint allows authenticated users with script-execution permissions to continue running previously-created scripts even after an administrator has disabled all script creation and execution, circumventing the security control intended to block this capability.

Technologies: Sonatype Nexus Repository, Sonatype Nexus Repository Manager. Vendors: Sonatype.

Quick answers

Is CVE-2026-77124 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-77124 being exploited in the wild.
How severe is CVE-2026-77124?: High severity, with a CVSS score of 7.2, published 2 September 2026.
Which products and versions are affected?: Sonatype Nexus Repository 3 (prior to 3.96.0).
Is there a fix for CVE-2026-77124?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-77124 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-77124?: Check whether you run Sonatype Nexus Repository or Sonatype Nexus Repository Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a privilege escalation flaw in the script execution endpoint (POST /service/rest/v1/script/{name}/run) of Nexus Repository 3. The endpoint fails to verify whether script execution has been administratively disabled via the nexus.scripts.allowCreation=false setting. An authenticated attacker with script-execution permission can invoke previously-created scripts after the administrator has disabled script execution, bypassing the intended security boundary. The attack requires a valid user account with script-execution role permissions and network access to the API endpoint. A patch is available in later versions of Nexus Repository 3.

Affected products

Sonatype Nexus Repository 3 (prior to 3.96.0)

Timeline

2026-09-02: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.