CVE-2026-3199

CVE-2026-3199 is a code execution vulnerability in the task management component of Sonatype Nexus Repository affecting versions 3.22.1 through 3.90.2. An authenticated attacker with task creation permissions can bypass the nexus.scripts.allowCreation security control to execute arbitrary code on affected systems. The vulnerability represents a privilege escalation risk, as it allows authorized users to exceed their intended access scope. The attack requires valid authentication credentials and task creation permissions, indicating moderate attack complexity. The potential impact is severe, as successful exploitation results in arbitrary code execution with the privileges of the Nexus Repository process. While specific CVSS metrics are unavailable, the FAUCET Risk Score of 53.0/100 reflects elevated concern. This vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog and is not actively being exploited in the wild. No widely available public exploit code has been reported, and community attention remains limited based on its inactive hot list status. However, the relatively straightforward attack path for privileged users warrants prompt patching.