Remote Input Vulnerability in Sonatype Nexus Repository Product

CVE-2026-97666

What is CVE-2026-97666?

Sonatype Nexus Repository 3 is vulnerable to an unauthenticated input manipulation flaw that can be exploited via an ExtDirect endpoint. This vulnerability allows attackers to send specially crafted input to a Java class loading call, enabling them to ascertain the presence of specific classes within the application. While this does not permit direct code execution, it poses a risk as it could facilitate further attacks or information leaks. Users of Nexus Repository are advised to implement the necessary updates and patches to mitigate this risk.

References