Medium severityNVD Advisory· Published Aug 7, 2026

CVE-2026-17596

Description

Nexus Repository 3 was found to be vulnerable to stored cross-site scripting (XSS). A user with the nexus:blobstores:create or nexus:blobstores:update permission could set a blob store name containing malicious script content, which would later execute in the browser of another user viewing system health-check status. This issue has been fixed in version 3.95.0.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Sonatype/Nexus Repositoryllm-fuzzy
Range: >=3.0.0 <3.95.0

Patches

Vulnerability mechanics

References

help.sonatype.com/en/sonatype-nexus-repository-3-95-0-release-notes.htmlnvd
support.sonatype.com/hc/en-us/articles/53871280401555/nvd

News mentions

No linked articles in our index yet.

cvss	0.260
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000