Sonatype Nexus - RCE (CVE-2020-10204)

CVE-2020-10204 is a high-severity remote code execution vulnerability in Sonatype Nexus Repository versions before 3.21.2. An authenticated attacker with high-level privileges can exploit the flaw remotely to execute arbitrary code, potentially compromising repository data, the underlying server, and system availability.

CrowdSec has been tracking this vulnerability and its exploits since 25th of August 2026.

Insights from the CrowdSec network reveal that the attackers trying to exploit CVE-2020-10204 are composed of a fairly even mix of opportunistic and targeted actors. Some attackers employ preliminary reconnaissance, while others use indiscriminate scanning. Data from the CrowdSec community also indicates a gradual decrease in attacks targeting CVE-2020-10204. While still present in the wild, exploitation levels have dropped noticeably week-over-week. This may signal that the vulnerability is becoming less relevant or that defenses are improving fast enough for attackers to lose interest.

Attackers target Nexus Repository Manager’s /service/rapture/session and /service/extdirect endpoints, authenticating before submitting a crafted coreui_User update request. The exploit injects an Expression Language payload into the user roles field to trigger remote code execution.