Vulnerabilities
Vulnerable Software

Vulnerability Details CVE-2026-17594

Nexus Repository 3 CE/Pro versions 3.0.0 through 3.94.x contain an incorrect authorization vulnerability (CWE-863) in the repository-creation user interface. An individual user account holding a delegated repository-admin privilege scoped to a specific repository format could create a repository of a different, unauthorized format, because authorization was checked against one request field while a separate, attacker-controlled field determined the repository format actually created. This does not affect the anonymous user, which cannot hold this privilege by default. Fixed in version 3.95.0.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.01
EPSS Ranking 62.8%
CVSS Severity
CVSS v3 Score 4.9
Products affected by CVE-2026-17594


Contact Us

Shodan ® - All rights reserved