RCE in Sonatype Nexus Repository 3

CVE-2026-17603

Nexus Repository 3 did not sufficiently restrict which HikariCP connection-pool properties could be set through the DataStore configuration API. A user holding the nx-datastores-update permission could set the connectionInitSql property to execute arbitrary SQL against the configured database on every new connection. On the default H2 database backend, this could be leveraged to achieve remote code execution as the Nexus process user.

Vulnerability class: RCE (Remote Code Execution)

Published · last modified .

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.009 (58.8th percentile), scored .

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 59th percentile — 58.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS trend (30 days)EPSS over the last 30 days for CVE-2026-17603: held from 0.005 to 0.009.

EPSS over last 30 days · oldest: 0.005 · newest: 0.009 · change: +0.004

Affected products

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2026-17603?
CVE-2026-17603 is a high-severity vulnerability in Sonatype Nexus Repository 3, classified under Code Injection. CVSS score: 8.8/10. Published 2026-08-07.
How severe is CVE-2026-17603?
High severity. CVSS v3 base score is 8.8 out of 10.