CVE-2020-10199: Sonatype Nexus Repository JavaEL injection enables remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityThe flaw is in CISA KEV with public exploit code and an EPSS probability above 0.99, and successful exploitation yields remote code execution on a supply-chain-critical server.

What it is

Sonatype Nexus Repository before 3.21.2 is vulnerable to Java Expression Language (JavaEL) injection, tracked as CWE-917. An authenticated attacker can inject EL expressions that the application evaluates, leading to remote code execution on the repository server. Because Nexus is a central artifact store, compromise can expose or tamper with the software supply chain it serves.

Impact

An attacker with a valid low-privileged account gains code execution on the Nexus host, with high impact to confidentiality, integrity and availability. This can lead to full server compromise and access to hosted artifacts and credentials.

Attack surface

The flaw is reachable over the network (AV:N) with low attack complexity and no user interaction, but it requires a low-privileged authenticated account (PR:L). No public detail in the record identifies the exact endpoint or parameter.

Exploitation

CVE-2020-10199 is listed in CISA KEV with a 2021-11-03 addition date, and EPSS shows a 30-day probability of 0.99064 (99.9th percentile). Public exploit references are present, so exploitation is expected and active.

What to do

• Upgrade Sonatype Nexus Repository to 3.21.2 or later per the vendor advisory.
• If immediate upgrade is not possible, restrict network access to the Nexus UI and APIs to trusted management networks.
• Audit and minimize accounts with repository or administrative privileges, and rotate credentials for any account that may have been exposed.
• Monitor vendor advisories for the companion issue referenced as issue 2 of 2 and apply the same fix baseline.

Detection

• Search Nexus server logs for requests containing JavaEL delimiters such as ${ or %{ in parameters, headers or repository paths.
• Alert on unexpected child processes spawned by the Nexus Java process (for example shells, curl or scripting interpreters).
• Monitor for outbound network connections from the Nexus host to unfamiliar destinations.
• Review authentication logs for use of low-privileged accounts against administrative or repository-management endpoints.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.