CVE-2026-97666
Received Received - Intake

Unauthenticated Class Enumeration in Sonatype Nexus Repository 3

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: Sonatype

Description
Sonatype Nexus Repository 3 allows an unauthenticated remote attacker to supply attacker-controlled input to a Java class loading call through an ExtDirect endpoint. This allows the attacker to learn whether specific classes are present in the application. The issue does not by itself allow code execution.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-15
AI Q&A
2026-10-15
EPSS Evaluated
N/A
NVD
CVE-2026-97666
EUVD
EUVD-2026-102153

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Sonatype Nexus Repository 3 3.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-470 The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-97666 is a vulnerability in Sonatype Nexus Repository 3 caused by unsafe reflection in the ExtDirect endpoint. An unauthenticated remote attacker can pass arbitrary strings to the ClassLoader.loadClass() method without validation. This acts as a class-existence oracle, allowing attackers to check which classes are present in the application's classloader, potentially revealing installed libraries and plugins. It does not directly enable code execution.

Detection Guidance

To detect this vulnerability, monitor network traffic for unauthorized requests to the ExtDirect endpoint in Sonatype Nexus Repository 3. Check logs for unusual class loading attempts or ClassLoader.loadClass() calls. No specific commands are provided in the resources.

Impact Analysis

This vulnerability allows attackers to gather information about the software environment, such as installed libraries and plugins. While it does not directly execute code, it could help attackers identify potential targets for further exploits or reconnaissance. The impact is limited to information disclosure but may assist in planning more severe attacks.

Mitigation Strategies

Immediately upgrade to Nexus Repository 3.97.0 or later. Alternatively, restrict network access to the web interface or configure a reverse proxy to require authentication for requests to the affected endpoint.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97666. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart