CVE-2026-97666

UNKNOWN 0.0

Nexus Repository 3 - Unsafe Reflection in ExtDirect Repository Endpoint

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Sonatype Nexus Repository 3 allows an unauthenticated remote attacker to supply attacker-controlled input to a Java class loading call through an ExtDirect endpoint. This allows the attacker to learn whether specific classes are present in the application. The issue does not by itself allow code execution.

CWE	CWE-470
Vendor	sonatype
Product	nexus repository 3
Published	Oct 15, 2026
Last Updated	Oct 15, 2026

Stay Ahead of the Next One

Get instant alerts for sonatype nexus repository 3

Be the first to know when new unknown vulnerabilities affecting sonatype nexus repository 3 are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Sonatype / Nexus Repository 3

3.0.0 < 3.97.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

help.sonatype.com: https://help.sonatype.com/en/sonatype-nexus-repository-3-97-0-release-notes.html support.sonatype.com: https://support.sonatype.com/hc/en-us/articles/56206649520147/

Credits

wupco123