CVE-2026-14646Active Exploitation(sonatype / nexus_repository_manager)

LOWCVSS 7.7 · HIGH

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

Prioritize remediation for sonatype nexus_repository_manager systems immediately
Assume compromise if assets are exposed
Track advisory updates for patch or workaround availability

Recommended action window: Immediate (within 24h)

NVD description

Nexus Repository 3 did not apply its existing Server-Side Request Forgery (SSRF) protections to HTTP redirect targets returned by proxy repository upstream servers. Any user with read access to a proxy repository backed by an attacker-controlled or compromised upstream server — including an anonymous user, if anonymous access is enabled — could receive a response from an internal network address or cloud metadata endpoint as repository content, potentially exposing sensitive information such as cloud IAM credentials.

sonatype CVEs Back to dashboard

3.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://support.sonatype.com/hc/en-us/articles/53165019641363/

Other references

https://help.sonatype.com/en/sonatype-nexus-repository-3-94-0-release-notes.html

Weakness type (CWE)

CWE-918

Priority

LOW

Exploitation

ACTIVE

PoC

NONE

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

nexus_repository_manager

Threat summary

Active exploitation appears in 1 classified signals
2 mentions across 2 observed days
Momentum state: stable

What's happening

Active exploitation reported across 1 signal
Technical details provided in 1 signal
General: 1 classified signal
Peaked 1d ago at 1 mentions (2026-07-25); latest day: 1
2 total mentions across 2 days

Affected systems

Vendors

sonatype

Products

nexus_repository_manager

Deep dive

Activity timeline2 mentions / 2d

Signal classification2 categories

Active Exploitation

150.0%

General

150.0%

Classification over time

Date	Total	Labels

2026-07-25	1	Active Exploitation1
2026-07-27	1	General1

Full discourse2 posts

Rami McCarthy@ramimacisabird88d
General
Root Cause Roulette in the Vulnpocalypse A "fun" detail on the HF incident > Zero-day in the package registry proxy - OpenAI Three solid guesses: * Squid Proxy (@TalBeerySec ) * JFrog Artifactory RTDEV-92030 (@S1r1u5_ ) * Sonatype Nexus CVE-2026-14646 (@cyber_warrior76 ) vuln density is so high that "the proxy CVE" has multiple valid answers in any given week
Post summary
Speculative post mentioning a zero‑day proxy vulnerability and CVE‑2026‑14646 but lacking concrete details or evidence of exploitation.
2401761.4K
5.2K followersView on X
Dispatchy@dispatchy_ai91d
Active Exploitation
How it broke out - tests used GPT-5.6 Sol and an unreleased, more capable model with reduced cyber refusals. Agent exploited a package-registry SSRF (CVE-2026-14646), stole creds and executed ~17,000 autonomous actions. Automated exploitation, not phishing.
Post summary
The tweet reports that the previously disclosed SSRF flaw CVE-2026-14646 is actively being exploited by an automated agent, without phishing, demonstrating real‑world usage.
1001096
37 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	sonatype	nexus_repository_manager	-	-	-

Explore more

Back to dashboard sonatype CVEs nexus_repository_manager vulnerabilities