CVE-2026-10748: Nexus Repository 3 - Remote Code Execution via License Deserialization

Synopsis

This is a remote code execution vulnerability in Sonatype Nexus Repository 3 (all versions from 3.0.0 up to but not including 3.92.0) caused by unsafe deserialization of uploaded license files. An attacker who holds the nx-licensing-create privilege can upload a crafted license file and execute arbitrary operating system commands as the Nexus process user. Successful exploitation gives the attacker full control over the host process, including the ability to read, modify, or destroy repository contents and secrets. A patched-image rebuild at version 3.92.0 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable license upload endpoint is exposed over the network, so the attacker must be able to reach the Nexus service via HTTP/HTTPS.

• AuthenticationRequired

  An account holding the nx-licensing-create privilege is required; a standard unprivileged account is not sufficient, but the privilege is narrower than full admin access.

• Victim interactionNot required

  No user action or social engineering is needed; the attacker sends the crafted license file directly to the endpoint.

• Attack complexityDetail

  Attack complexity is low: exploitation is reliable and requires no race conditions, specific memory layout, or environmental preconditions beyond holding the required privilege.

Blast Radius

• Arbitrary OS commands execute as the Nexus process user, giving the attacker a foothold on the underlying host.
• The attacker can read all repository artifacts, credentials, and secrets stored or cached by the Nexus process.
• The attacker can modify or delete repository contents, including hosted artifacts and proxied component metadata.
• The attacker can crash or destabilize the Nexus service, disrupting artifact availability for any downstream build pipelines that depend on it.