CVE-2026-97712
Nexus Repository 3 - Privilege Escalation via Role Management
Sonatype Nexus Repository 3Applications & CMS
CVSS
8.7HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.27%Chance of exploitation activity in the next 30 days, higher than 17% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 3.97.0Nexus Repository 3CVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Sonatype Nexus Repository 3 allows a user that holds the role create or role update permission to grant roles and privileges that the account does not hold. This can give the user more access than intended, up to full administrative access.
Text from CVE List
Affected versions 1
- Nexus Repository 3affected: 3.0.0 before 3.97.0CVE List