CVE-2026-97666
Nexus Repository 3 - Unsafe Reflection in ExtDirect Repository Endpoint
- State
- Published
- Severity
- 6.9 Medium
- Published
- Oct 15, 2026
- Updated
- Oct 15, 2026
- Reserved
- Sep 24, 2026
Description
Sonatype Nexus Repository 3 allows an unauthenticated remote attacker to supply attacker-controlled input to a Java class loading call through an ExtDirect endpoint. This allows the attacker to learn whether specific classes are present in the application. The issue does not by itself allow code execution.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N | Sonatype |
Weaknesses
- CWE-470 Use of Externally-Controlled Input to Select Classes or Code ("Unsafe Reflection")
Affected Products
| Product | Versions |
|---|---|
Nexus Repository 3Sonatype |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.