---
id: "CVE-2020-10199"
kind: "vulnerability"
aliases: ["CVE-2020-10199"]
title: "Sonatype Nexus Repository: Sonatype Nexus Repository Remote Code Execution Vulnerability"
severity: "critical"
cvss: 9.0
epss: 0.99064
exploited: true
status: "open"
category: "package"
products: [{"name": "Sonatype Nexus Repository", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "java", "nexus-repository", "package", "self-hosted"]
not_affected_if: ["managed-hosting"]
published_at: "2020-04-01T19:15:14+00:00"
first_seen_at: "2026-10-23T19:11:53+00:00"
updated_at: "2026-10-23T21:57:34+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-10199", "first_seen_at": "2026-10-23T19:11:53+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2020-10199", "first_seen_at": "2026-10-23T19:13:43+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10199", "first_seen_at": "2026-10-23T21:57:34+00:00"}]
---

# Sonatype Nexus Repository: Sonatype Nexus Repository Remote Code Execution Vulnerability

Sonatype Nexus Repository has an unspecified flaw that allows remote code execution. CISA lists it as actively exploited in the wild, and the EPSS exploitation probability is 0.991.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Sonatype Nexus Repository affected ? fixed ?

## Fix

Apply updates per vendor instructions (CISA required action); the fixed version is not stated in the sources.

## Timeline

- 2026-10-23T19:11:53+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-10199
- 2026-10-23T19:13:43+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2020-10199
- 2026-10-23T21:57:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2020-10199

## From the sources

Sonatype Nexus Repository contains an unspecified vulnerability that allows for remote code execution.

CISA required action: Apply updates per vendor instructions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_