CVE-2026-77124 Security Details

CVE ID

CVE-2026-77124

CWE

CWE-184

CVE Description

In affected versions of Nexus Repository 3, the script execution endpoint (POST /service/rest/v1/script/{name}/run) did not verify whether script execution had been administratively disabled. An account holding script-execution permission could continue to run previously-created scripts even after an administrator set nexus.scripts.allowCreation=false, undermining the expectation that this setting fully blocks script execution.

Published

Aug 21, 2026

CVSS Score & Severity

7.2High

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS Score

0.724%

Malware

malware

KEV Status

Not in KEV Catalog: No known exploits

Vulnerable Methods

org/sonatype/nexus/script/plugin/internal/rest/ScriptResource.run(Ljava/lang/String;Ljava/lang/String;)Lorg/sonatype/nexus/script/ScriptResultXO;

JVM

org/sonatype/nexus/script/plugin/internal/rest/ScriptResource.run(Ljava/lang/String;Ljava/lang/String;)Lorg/sonatype/nexus/script/ScriptResultXO;

JVMVulnerable params: 0

Affected Ecosystems

affected

Source

National Vulnerability Database

References

support.sonatype.comPROJECT