Sonatype Nexus - RCE (CVE-2020-10204)

CVE-2020-10204 is a high-severity remote code execution vulnerability in Sonatype Nexus Repository versions before 3.21.2. An authenticated attacker with high-level privileges can exploit the flaw remotely to execute arbitrary code, potentially compromising repository data, the underlying server, and system availability.

CrowdSec has been tracking this vulnerability and its exploits since 25th of August 2026.

CrowdSec network data shows that most actors exploiting CVE-2020-10204 rely on broad, untargeted scans with minimal filtering. The activity is largely automated and opportunistic in nature. CrowdSec data also reveals a clear uptick in attacks involving CVE-2020-10204 over the past week. Activity is above the usual baseline, suggesting growing attention from attackers. This may reflect rising awareness, recent exploit releases, or expanded targeting efforts.

Attackers target Nexus Repository Manager’s /service/rapture/session and /service/extdirect endpoints, authenticating before submitting a crafted coreui_User update request. The exploit injects an Expression Language payload into the user roles field to trigger remote code execution.