CVE-2026-17598: Sonatype Nexus Repository Manager

Medium severity, CVSS 4.9. EPSS: 0.2% chance of exploitation in the next 30 days.

Sonatype Nexus Repository 3 did not properly filter internal configuration keys from user-supplied task properties when creating or updating a scheduled task through the administrative UI. An account holding permission to create at least one scheduled task type could supply a crafted property value that caused the system to overwrite the configuration of an unrelated, existing task instead of creating a new one.

Affected products

• Sonatype Nexus Repository Manager: from 3.91.0, before 3.95.0 (fixed in 3.95.0)

Published 2026-08-07. Last modified 2026-09-22.