Sonatype Nexus Repository 3 Stored XSS Vulnerability (CVE-2026-17596) Advisory

Vulnerability Overview Vulnerability Name: CVE-2026-17596 Vulnerability Type: Stored Cross-Site Scripting (XSS) Vulnerability Description: Nexus Repository 3 contains a stored cross-site scripting (XSS) vulnerability. Attackers with the or permissions can set the blob store name to include malicious scripts. When other users (such as administrators) view the system health check status, the malicious script executes in their browser, enabling operations within the context of a higher-privileged user session. Scope of Impact Affected Versions: Sonatype Nexus Repository 3 CE/Pro versions 3.16.0 through 3.94.x Fixed Versions: Sonatype Nexus Repository 3 CE/Pro version 3.95.0 Remediation Recommended Action: Upgrade to Sonatype Nexus Repository 3 CE/Pro version 3.95.0 or later. Immediate Mitigation: Restrict and permissions to administrators only, and avoid viewing the system health check status prior to upgrading to prevent execution from untrusted blob store names. Additional Information CVSS Score: 6.3 (Medium) CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Sonatype Guidance: https://jgud.sonatype.com/vulnerability/CVE-2026-17596 Frequently Asked Questions Risk: Attackers can inject scripts that execute within an administrator session, leading to unauthorized actions or information disclosure. Prerequisites: The attacker must have or permissions, and the victim must view the system health check status page. Disclosure Policy: Sonatype is committed to responsible disclosure and proactively notifies users to protect their systems. Related Articles CVE-2026-17603 Nexus Repository 3 - HikariCP connectionInitSql Injection RCE via DataStore Configuration API CVE-2026-17600 Nexus Repository 3 - Session Not Invalidated on Account Deletion or Deactivation Footer Information Copyright: © 2008-present, Sonatype Inc. All rights reserved. Trademark Notice: Sonatype and Sonatype Nexus are trademarks of Sonatype, Inc. Apache Maven and Maven are trademarks of the Apache Software Foundation. Eclipse is a trademark of the Eclipse Foundation. Other trademarks belong to their respective owners.

Goal Reached Thanks to every supporter — we hit 100%!

Sonatype Nexus Repository 3 Stored XSS Vulnerability (CVE-2026-17596) Advisory