CVE-2026-97666: Nexus Repository 3 - Unsafe Reflection in ExtDirect Repository Endpoint
Published Oct 15, 2026
·Updated
Sonatype Nexus Repository 3 allows an unauthenticated remote attacker to supply attacker-controlled input to a Java class loading call through an ExtDirect endpoint. This allows the attacker to learn whether specific classes are present in the application. The issue does not by itself allow code execution.
Affected Software
1 affected component
Sonatype Nexus Repository 3
Event History
Oct 15, 2026
CVE Published
via MITRE·03:34 PM
Data Sourced
via MITRE·03:34 PM
DescriptionWeakness
Frequently Asked Questions
1
Who can exploit this issue?
An unauthenticated remote attacker can reach the affected ExtDirect repository endpoint and provide attacker-controlled input.
2
What can an attacker achieve?
The attacker can determine whether specific Java classes are present in the application. The issue alone does not provide code execution.