ACTIVELY EXPLOITED
CVE-2020-10199: Sonatype Nexus Repository Remote Code Execution Vulnerability
| Vendor | Sonatype |
|---|---|
| Product | Nexus Repository |
| Actively exploited | Yes |
| Added to CISA KEV | 3 Nov 2021 |
| CISA federal deadline | 3 May 2022 |
| Weakness (CWE) | CWE-917 |
Required action (CISA's text)
Apply updates per vendor instructions.
Description (NVD)
Sonatype Nexus Repository contains an unspecified vulnerability that allows for remote code execution.
SOURCES
Other Sonatype flaws
Data from NVD, CISA KEV, FIRST EPSS and vendor advisories. Updated 10 Nov 2026.