CVE-2026-10741

MEDIUM EPSS 17.3%

Published Jun 17, 20261w ago · Modified Jun 23, 20261w ago

5.9 CVSS 4.0

Medium

Published Jun 17, 2026 1w ago

Last Modified Jun 23, 2026 1w ago

Description

Sonatype Nexus Repository Manager before 3.93.0 contains an authorization vulnerability in the proxy repository configuration that allows a delegated repository administrator to disclose stored upstream proxy credentials.

CVSS Details

Base Score

5.9

Exploitability

—

Impact

—

Vector string

CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector Network

Attack Complexity Low

Privileges Required High

User Interaction None

Scope X

Threat Intelligence

EPSS Exploit Probability

17.3% percentile

Exploit & Patch Status

No Known Exploit

No Patch Available

Weaknesses 1

CWE-863 Incorrect Authorization Authorization

References 2

help.sonatype.com https://help.sonatype.com/en/sonatype-nexus-repository-3-93-0-release-notes.html
support.sonatype.com https://support.sonatype.com/hc/en-us/articles/52341191736851

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.