Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-113370

Sonatype Nexus Repository 3 contains a SQL injection vulnerability in the optional "Reindex Search…

Risk score
46/100
CVSS
7.7 v4.0
Published
4 Nov 2026

Open in the live forecast Today's forecast

What to know

What it is
Sonatype Nexus Repository 3 contains a SQL injection vulnerability in the optional "Reindex Search Tables By Pattern" task. A user who holds the nexus:tasks:create privilege can supply a crafted filter condition that the database runs as SQL. This allows the user to modify data in the Nexus database. The task is avail…
Affected
See advisory
Fix
Apply the vendor's security update; see the linked advisory.
Exploitation
No known exploitation

Why it is Yellow

  • CVSS 7.7 high

References

Original description

Sonatype Nexus Repository 3 contains a SQL injection vulnerability in the optional "Reindex Search Tables By Pattern" task. A user who holds the nexus:tasks:create privilege can supply a crafted filter condition that the database runs as SQL. This allows the user to modify data in the Nexus database. The task is available only when the non-default setting nexus.reindex.search.by.pattern.visible is set to true.

Last activity 4 Nov 2026. Patch Forecast updates every hour.