CVE-2025-9868: Nexus Repository 2 - SSRF Vulnerability in Remote Browser Plugin

Q: What is the severity of CVE-2025-9868?

CVE-2025-9868 is considered a critical severity vulnerability that allows unauthorized access to sensitive information.

Q: How do I fix CVE-2025-9868?

To fix CVE-2025-9868, upgrade to Sonatype Nexus Repository version 2.15.3 or later.

Q: Who is affected by CVE-2025-9868?

CVE-2025-9868 affects users of Sonatype Nexus Repository versions up to and including 2.15.2.

Q: What type of attack does CVE-2025-9868 enable?

CVE-2025-9868 enables Server-Side Request Forgery (SSRF) attacks allowing attackers to exfiltrate proxy repository credentials.

Q: Can CVE-2025-9868 be exploited remotely?

Yes, CVE-2025-9868 can be exploited by unauthenticated remote attackers through crafted HTTP requests.

Published Oct 8, 2025

Updated

Server-Side Request Forgery (SSRF) in the Remote Browser Plugin in Sonatype Nexus Repository 2.x up to and including 2.15.2 allows unauthenticated remote attackers to exfiltrate proxy repository credentials via crafted HTTP requests.

Affected Software

1 affected component

Sonatype Nexus Repository<=2.15.2

Event History

Oct 8, 2025

CVE Published

via MITRE·05:07 PM

Data Sourced

via MITRE·05:07 PM

DescriptionWeakness

Data Sourced

via NVD·06:15 PM

DescriptionSeverityWeakness

Feb 28, 57989

Event

via FIRST·06:24 AM

Frequently Asked Questions

What is the severity of CVE-2025-9868?

CVE-2025-9868 is considered a critical severity vulnerability that allows unauthorized access to sensitive information.

How do I fix CVE-2025-9868?

To fix CVE-2025-9868, upgrade to Sonatype Nexus Repository version 2.15.3 or later.

Who is affected by CVE-2025-9868?

CVE-2025-9868 affects users of Sonatype Nexus Repository versions up to and including 2.15.2.

What type of attack does CVE-2025-9868 enable?

CVE-2025-9868 enables Server-Side Request Forgery (SSRF) attacks allowing attackers to exfiltrate proxy repository credentials.

Can CVE-2025-9868 be exploited remotely?