Sonatype Nexus Repository Manager 2.11

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:sonatype:nexus_repository_manager:2.11:*:*:*:*:*:*:*

part: a version: 2.11 update: *

VendorSonatype (4f13373e-a28c-5625-a507-2b5658f30fd0)
ProductNexus Repository Manager (b0d475df-7c29-5589-9f88-bb4315bcf5a7)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*

Notes

Imported from NVD CPE 2.0 feed

PURL mappings

PURLSourceLast updated
pkg:docker/sonatype/nexus purl2cpe 2026-06-01 10:16:49.042014
pkg:github/sonatype/docker-nexus purl2cpe 2026-06-01 10:16:49.042015
pkg:github/sonatype/nexus-public purl2cpe 2026-06-01 10:16:49.042016
pkg:sonatype/repomanager2 purl2cpe 2026-06-01 10:16:49.042018

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2026-17593 vulnerable 2026-09-16 04:33:03.132315 Nexus Repository - Arbitrary Class Instantiation via Unsafe Realm Configuration
An account holding the nexus:settings:update permission in Nexus Repository 3 (or the equivalent nexus:settings permission in the legacy Nexus Repository 2) could submit arbitrary values as realm identifiers through an internal configuration API that did not validate them against the set of registered realms. Because unrecognized entries were persisted and re-evaluated on every realm load via a legacy code path, this could result in unintended code executing inside the Nexus Repository process, and in some cases a persistent authentication lockout that was not visible through the administrative UI.
Published: 2026-08-07T16:07:43.642Z
Updated: 2026-08-08T03:55:43.275Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Inspect record JSON

Open JSON directly

Open this panel to browse, search, copy or download the JSON record.