CVE-2026-17600Nexus Repository 3 - Session Not Invalidated on User Account Deletion or Deactivation
Updated under an hour ago ()
Does this affect you?
It affects Sonatype Nexus Repository 3 and 3 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
Sonatype Nexus Repository 3 did not immediately terminate a user's active login session or revoke their cached permissions when that user's account was deleted, deactivated, or had its password changed. A user whose account was already logged in at the time of one of these actions could continue using their existing session to interact with the repository as though the account were still active, until that session independently expired. Depending on the permissions previously held, this could allow continued unauthorized access to read, modify, or delete repository content after access was intended to be revoked.
- CVSS
- 8.7 HIGH (v4.0, CNA)CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- Weakness (CWE)
- CWE-613
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Sonatype
- NVD analysis
- Analyzed
- Record last updated
- Aug 7, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Sonatype Nexus Repository 3 sonatype:nexus_repository_manager | from 3.0.0 before 3.95.0 | CNA record |
Sonatype org.sonatype.security:security-system sonatype:org.sonatype.security_security_system (from the name) | from 1.1.0 through 3.3 | CNA record |
Sonatype org.sonatype.nexus:nexus-security sonatype:org.sonatype.nexus_nexus_security (from the name) | from 2.6.0-01 through 3.88.0-08 | CNA record |
Sonatype org.sonatype.nexus.common.components:nexus-security sonatype:org.sonatype.nexus.common.components_nexus_security (from the name) | from 3.89.0-09 before 3.95.0 | CNA record |
sonatype nexus_repository_manager sonatype:nexus_repository_manager | from 3.0.0 before 3.95.0 | NVD |
References
- https://help.sonatype.com/en/sonatype-nexus-repository-3-95-0-release-notes.htmlpatch, release-notes
- https://support.sonatype.com/hc/en-us/articles/53888843674003/vendor-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.