VULNERABILITY INTELLIGENCE

CVE-2026-10748

CVSS score8.6 HIGH
EPSS probability0.32%
CISA KEVNot currently listed
Published2026-06-16
Last modified2026-10-25
CVSS vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Description

An authenticated user with the nx-licensing-create privilege can upload a specially crafted license file to execute arbitrary operating system commands as the Nexus process user in Sonatype Nexus Repository 3 versions before 3.92.0.

Weakness classification

  • CWE-502: Deserialization of Untrusted Data

Primary references