A remote, unauthenticated attacker can exploit the Nexus Repository Manager authentication endpoints to perform credential‑guessing attempts. The vulnerability allows an attacker to repeatedly try login credentials without restriction, potentially leading to account compromise or unauthorized access to protected artifacts. The weakness is a classic example of CWE‑307, which describes insufficient protection against authentication failures. Successful exploitation could enable an attacker to retrieve or modify repository content, disrupt service availability or gain foothold for further lateral movement.

Sonatype Nexus Repository Manager is affected. All versions listed in the CPE data, from early 3.1.0 up to 3.92.3, are potentially vulnerable. Administrators should verify their current Nexus version against this range and consider whether their deployment is within this spectrum.

The CVSS score of 8.7 indicates high severity, signifying substantial impact if exploited. While the EPSS score is not available, the absence of a Kaspersky Exploit Vulnerability (KEV) listing does not negate the risk; it simply means there is no confirmed exploitation at the time of reporting. Based on the description, the likely attack vector is a network‑based brute‑force attempt against exposed authentication services, requiring no special privileges from the attacker. The vulnerability therefore poses a significant risk of credential compromise if no mitigating controls are in place.