CVE-2026-3438: Sonatype Nexus Repository Manager

Medium severity, CVSS 6.1. EPSS: 0.6% chance of exploitation in the next 30 days.

A reflected cross-site scripting vulnerability exists in Sonatype Nexus Repository versions 3.0.0 through 3.90.2 that allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser through a specially crafted URL. Exploitation requires user interaction.

Affected products

• Sonatype Nexus Repository Manager: from 3.0.0, before 3.91.0 (fixed in 3.91.0)

Published 2026-04-08. Last modified 2026-09-18.