Get real-time updates on Telegram
CVE-2026-14645: nexus repository manager from 3.0.0 (inclusive), before 3.94.0 (exclusive); +1 more affected products
CVE-2026-14645. CVSS 3.1 base score 5.5 (MEDIUM, NVD). EPSS 0.00258 (percentile 0.16548), scored 24-Oct-2026.
Affected technology
nexus repository manager · from 3.0.0 (inclusive), before 3.94.0 (exclusive)
sonatype
Nexus Repository 3 · 3.0.0 to before 3.94.0
Sonatype
Description’s affected range: before making an outbound HTTP request
Component: Not specified by the source
Attack conditions (Source advisory, CVSS 4.0): Network (remote) · High privileges required · No user interaction required
What an attacker can do
So an unauthenticated user could also trigger this behavior if the anonymous role has been granted the permission. Source advisory’s CVSS 4.0 assessment (base score 5.1/10) rates confidentiality and availability impact as none; integrity impact as low.
- CWE
- CWE-918
- CCR priority
- 22.1 /100 (P4)
- CVSS 3.1
- 5.5 /10 · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N · NVD
- EPSS
- 0.00258 · percentile 0.16548 · 2026-10-24
- KEV
- no
Provenance
- NVD CVE API 2.0 · Source record · observed 2026-10-25 01:28:19.133527+00:00 UTC
Stable permalink: https://cybercodered.org/item/cve-cve-2026-14645.html