org.sonatype.security/security-system vulnerabilities

Latest org.sonatype.security/security-system CVEs

Newest publication first

1. CVE-2026-17600 Nexus Repository 3 - Session Not Invalidated on User Account Deletion or Deactivation

   Published 2026-08-07

   High·CVSS 8.7 EPSS 0.44%

   Sonatype Nexus Repository 3 did not immediately terminate a user's active login session or revoke their cached permissions when that user's account was deleted, deactivated, or had its password changed. A user whose account was already logged in at the time of one of these action...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.