CVE-2026-97666— Nexus Repository 3 - Unsafe Reflection in ExtDirect Repository Endpoint
Quick assessment
Affected
Sonatype Nexus Repository 3
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Sonatype Nexus Repository 3 允许未经身份验证的远程攻击者通过 ExtDirect 端点，向 Java 类加载调用提供攻击者可控的输入。这使得攻击者能够判断应用程序中是否存在特定类。该漏洞本身并不允许执行任意代码。
Possible ATT&CK Techniques 1 AI
T1203 · Exploitation for Client ExecutionAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Sonatype | Nexus Repository 3 | 3.0.0< 3.97.0 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-97666
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Nexus Repository 3 - Unsafe Reflection in ExtDirect Repository Endpoint
Source: CVE Program / CVE List V5
Vulnerability Description
Sonatype Nexus Repository 3 allows an unauthenticated remote attacker to supply attacker-controlled input to a Java class loading call through an ExtDirect endpoint. This allows the attacker to learn whether specific classes are present in the application. The issue does not by itself allow code execution.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
使用外部可控制的输入来选择类或代码(不安全的反射)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Sonatype | Nexus Repository 3 | 3.0.0 ~ 3.97.0 |
cpe:2.3:a:sonatype:nexus_repository_manager:3.0.0:*:*:*:*:*:*:*
|
|
II. Public POCs for CVE-2026-97666
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-97666
请登录查看更多情报信息。
Vendor Pages for CVE-2026-97666 (1)
Same Patch Batch · Sonatype · 2026-10-15 · 4 CVEs total
| CVE-2026-97712 | 8.7 HIGH | Nexus Repository 3 - Privilege Escalation via Role Management |
| CVE-2026-97665 | 7.1 HIGH | Nexus Repository 3 - Missing Authorization on NuGet Symbol Package Upload |
| CVE-2026-97667 | 5.1 MEDIUM | Nexus Repository 3 - Stored Cross-Site Scripting in Browse UI |
IV. Related Vulnerabilities
Same product: Nexus Repository 3
-
CVE-2026-97667
Nexus Repository 3 - Stored Cross-Site Scripting in Browse U -
CVE-2026-97712
Nexus Repository 3 - Privilege Escalation via Role Managemen -
CVE-2026-97665
Nexus Repository 3 - Missing Authorization on NuGet Symbol P -
CVE-2026-77123
Nexus Repository 3 - Webhook Secret Disclosure via Capabilit -
CVE-2026-77124
Nexus Repository 3 - Script Execution Disable Setting Not En
Same vendor: Sonatype
-
CVE-2026-97712
Nexus Repository 3 - Privilege Escalation via Role Managemen -
CVE-2026-97667
Nexus Repository 3 - Stored Cross-Site Scripting in Browse U -
CVE-2026-97665
Nexus Repository 3 - Missing Authorization on NuGet Symbol P -
CVE-2026-77123
Nexus Repository 3 - Webhook Secret Disclosure via Capabilit -
CVE-2026-77124
Nexus Repository 3 - Script Execution Disable Setting Not En
Same weakness: CWE-470
-
CVE-2026-104629
Grid Protection Alliance openPDC and openHistorian Use of Ex -
CVE-2026-92415
Apache Jackrabbit: DavEx client runs Class.forName + (String -
CVE-2026-106440
Hydra: Optuna custom_search_space can resolve and execute un -
CVE-2026-106439
Hydra: Mutable instantiate policy sets allow target blocklis -
CVE-2026-105782
Scrapy: Arbitrary Module Import via Referrer-Policy Header i
V. Comments for CVE-2026-97666
No comments yet