ACTIVELY EXPLOITED
CVE-2019-7238: Sonatype Nexus Repository Manager Incorrect Access Control Vulnerability
| Vendor | Sonatype |
|---|---|
| Product | Nexus Repository Manager |
| Actively exploited | Yes |
| Added to CISA KEV | 10 Dec 2021 |
| CISA federal deadline | 10 Jun 2022 |
Required action (CISA's text)
Apply updates per vendor instructions.
Description (NVD)
Sonatype Nexus Repository Manager before 3.15.0 has an incorrect access control vulnerability. Exploitation allows for remote code execution.
SOURCES
Other Sonatype flaws
Data from NVD, CISA KEV, FIRST EPSS and vendor advisories. Updated 10 Nov 2026.