Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-97665— Nexus Repository 3 - Missing Authorization on NuGet Symbol Package Upload

Quick assessment

Affected
Sonatype Nexus Repository 3
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Nexus Repository 3 的 NuGet Components API 上传路径存在权限验证缺失漏洞。该漏洞允许仅拥有仓库“读取”和“浏览”权限的用户上传并持久化存储 NuGet 符号包（.snupkg）到托管仓库，从而绕过了常规包上传所强制执行的“写入”权限检查。 利用此漏洞的前提条件是：必须存在一个启用了“符号服务器”（Symbol Server）功能的托管 NuGet 仓库。如果启用了匿名访问，则内置的匿名用户在所有仓库中默认拥有“读取”和“浏览”权限，因此该前提条件无需使用已认证账户即可满足。

CVSS 7.1 · High EPSS 0.28% · P19

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

VendorProduct Version RangeStatus
Sonatype Nexus Repository 3 3.95.0< 3.97.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-97665

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Nexus Repository 3 - Missing Authorization on NuGet Symbol Package Upload
Source: CVE Program / CVE List V5
Vulnerability Description
A missing authorization check in Nexus Repository 3's NuGet Components API upload path allows an account holding only repository read and browse privileges to upload and persist NuGet symbol packages (.snupkg) to a hosted repository, bypassing the write-permission check enforced for ordinary package uploads. Exploitation requires a hosted NuGet repository with Symbol Server enabled. If anonymous access is enabled, the built-in anonymous user holds read and browse privileges across all repositories by default, so this precondition can also be met without an authenticated account.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Sonatype Nexus Repository 3 3.95.0 ~ 3.97.0 cpe:2.3:a:sonatype:nexus_repository_manager:3.95.0:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-97665

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-97665

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-97665 (1)

Vendor Pages for CVE-2026-97665 (1)

Same Patch Batch · Sonatype · 2026-10-15 · 4 CVEs total

CVE-2026-97712 8.7 HIGH Nexus Repository 3 - Privilege Escalation via Role Management
CVE-2026-97666 6.9 MEDIUM Nexus Repository 3 - Unsafe Reflection in ExtDirect Repository Endpoint
CVE-2026-97667 5.1 MEDIUM Nexus Repository 3 - Stored Cross-Site Scripting in Browse UI

IV. Related Vulnerabilities

Same product: Nexus Repository 3
Same vendor: Sonatype
Same weakness: CWE-862

V. Comments for CVE-2026-97665

No comments yet

Leave a comment