# CVE-2026-77124: Sonatype Nexus Repository privilege escalation in script execution

Source: https://junglewise.ai/threats/cve-2026-77124-sonatype-nexus-repository-privilege-escalation-in-script  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-02. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-77124 · Severity: high · CVSS 7.2 · Published 2026-09-02

Nexus Repository is a widely-used software component management system that allows organizations to manage and store software artifacts. A flaw in the script execution endpoint allows authenticated users with script-execution permissions to continue running previously-created scripts even after an administrator has disabled all script creation and execution, circumventing the security control intended to block this capability.

Technologies: [Sonatype Nexus Repository](https://junglewise.ai/threats/technologies/nexus-repository), [Sonatype Nexus Repository Manager](https://junglewise.ai/threats/technologies/nexus-repository-manager). Vendors: [Sonatype](https://junglewise.ai/threats/vendors/sonatype).

## Quick answers

**Is CVE-2026-77124 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-77124 being exploited in the wild.

**How severe is CVE-2026-77124?** High severity, with a CVSS score of 7.2, published 2 September 2026.

**Which products and versions are affected?** Sonatype Nexus Repository 3 (prior to 3.96.0).

**Is there a fix for CVE-2026-77124?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-77124 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-77124?** Check whether you run Sonatype Nexus Repository or Sonatype Nexus Repository Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a privilege escalation flaw in the script execution endpoint (POST /service/rest/v1/script/{name}/run) of Nexus Repository 3. The endpoint fails to verify whether script execution has been administratively disabled via the nexus.scripts.allowCreation=false setting. An authenticated attacker with script-execution permission can invoke previously-created scripts after the administrator has disabled script execution, bypassing the intended security boundary. The attack requires a valid user account with script-execution role permissions and network access to the API endpoint. A patch is available in later versions of Nexus Repository 3.

## Affected products

- Sonatype Nexus Repository 3 (prior to 3.96.0)

## Timeline

- 2026-09-02: disclosed

## References

- [https://help.sonatype.com/en/sonatype-nexus-repository-3-96-0-release-notes.html](https://help.sonatype.com/en/sonatype-nexus-repository-3-96-0-release-notes.html)
- [https://support.sonatype.com/hc/en-us/articles/54641528273811/](https://support.sonatype.com/hc/en-us/articles/54641528273811/)

## Related threats

- [Sonatype Nexus Repository authorization bypass in blobstore management](https://junglewise.ai/threats/cve-2026-77125-sonatype-nexus-repository-authorization-bypass-in-blobstore)
- [Sonatype Nexus Repository 3 sensitive information disclosure in capability API](https://junglewise.ai/threats/cve-2026-77123-sonatype-nexus-repository-3-sensitive-information-disclosure-in)
- [Sonatype Nexus Repository authorization bypass in REST API](https://junglewise.ai/threats/cve-2026-77122-sonatype-nexus-repository-authorization-bypass-in-rest-api)
- [Sonatype Nexus Repository denial of service via oversized POM metadata](https://junglewise.ai/threats/cve-2026-77121-sonatype-nexus-repository-denial-of-service-via-oversized-pom)
- [Nexus Repository 3 did not sufficiently restrict which HikariCP connection-pool properties could be set through the…](https://junglewise.ai/threats/cve-2026-17603-nexus-repository-3-did-not-sufficiently-restrict-which-hikaricp)