Sonatype Nexus Repository Manager versions 3.0.0 through 3.70.5 contain hard‑coded administrative credentials that, when the binary listener feature is enabled, allow an unauthenticated network attacker to read and write the internal database and execute arbitrary operating‑system commands as the Nexus process user. This flaw is a classic CWE‑798 hard‑coded credential issue, enabling a privilege escalation from no authentication to full system compromise.

Affected systems are Sonatype Nexus Repository Manager installations running any version between 3.0.0 and 3.70.5 inclusive. The vulnerability is present in every release within that range, regardless of minor patch level. All environments that expose the binary listener endpoint to an attacker‑accessible network are susceptible.

The flaw carries a high severity with a CVSS score of 9.2 and is considered a high‑risk attack vector: it requires network connectivity to the Nexus server and a configuration setting (nexus.orient.binaryListenerEnabled=true). The exploit would provide an attacker with full read/write database access and the ability to execute arbitrary commands as the running Nexus process. Current EPSS data is unavailable, and the vulnerability is not listed in the CISA KEV catalog, but its CVSS score and wide distribution make it a significant risk.