Critical Remote Code Execution in Sonatype Nexus Repository (CVE‑2020‑10199) Threatens Software Supply Chains
What It Is — Sonatype Nexus Repository Manager contains an unspecified vulnerability that permits remote code execution. The flaw is actively exploited and carries a CVSS v3.1 base score of 9.8 (Critical).
Exploitability — Listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog; public exploits have been observed.
Affected Products — Sonatype Nexus Repository Manager (all supported versions prior to the vendor’s security patch).
Why It Matters for Trust & Control Assurance
- Highlights the need for continuous third‑party risk monitoring and timely patch management across the software supply chain.
- Provides a concrete data point for auditors to verify that high‑severity vulnerabilities are identified, remediated, and documented.
- Demonstrates the value of maintaining defensible evidence of remediation in a centralized Trust Center.
Recommended Actions
- Inventory all Nexus Repository instances and verify current version.
- Apply the vendor‑released patch immediately; if patching is delayed, isolate the service.
- Record remediation steps and retain evidence for audit purposes.
- Enable continuous monitoring for unpatched versions and integrate findings into your third‑party risk program.
Source: CISA KEV – CVE‑2020‑10199