CVE-2026-97666 Security Details

CVE ID

CVE-2026-97666

CWE

N/A

CVE Description

Nexus Repository 3 - Unauthenticated File Probing via ExtDirect Classloader

Published

Oct 5, 2026

CVSS Score & Severity

6.9Medium

CVSS Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

EPSS Score

0%

Malware

malware

KEV Status

Not in KEV Catalog: No known exploits

Vulnerable Methods

org/sonatype/nexus/coreui/RepositoryComponent.readReferencesAddingEntriesForAllFormats(Lorg/sonatype/nexus/repository/config/StoreLoadParameters;)Ljava/util/List;

JVMVulnerable params: 0

org/sonatype/nexus/coreui/RepositoryComponent.readReferencesAddingEntryForAll(Lorg/sonatype/nexus/repository/config/StoreLoadParameters;)Ljava/util/List;

JVMVulnerable params: 0

org/sonatype/nexus/internal/app/GlobalComponentLookupHelperImpl.type(Ljava/lang/String;)Ljava/lang/Class;

JVMVulnerable params: 0

Affected Ecosystems

affected

Source

National Vulnerability Database

References

support.sonatype.comPROJECT