CVE-2026-97666
Sonatype Nexus Repository 3 allows an unauthenticated remote attacker to supply attacker-controlled…
- Risk score
- 50/100
- CVSS
- 6.9 v4.0
- Exploit chance (30 days)
- 0.6%
- Published
- 15 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Sonatype Nexus Repository 3 allows an unauthenticated remote attacker to supply attacker-controlled input to a Java class loading call through an ExtDirect endpoint. This allows the attacker to learn whether specific classes are present in the application. The issue does not by itself allow code execution.
- Affected
- See advisory
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 6.9 medium
References
Original description
Sonatype Nexus Repository 3 allows an unauthenticated remote attacker to supply attacker-controlled input to a Java class loading call through an ExtDirect endpoint. This allows the attacker to learn whether specific classes are present in the application. The issue does not by itself allow code execution.
Last activity 15 Oct 2026. Patch Forecast updates every hour.