Medium severity · published Oct 15, 2026
CVE-2026-97666
Nexus Repository 3 - Unsafe Reflection in ExtDirect Repository Endpoint
6.9
CVSS
0.6%
EPSS
No
On KEV
Description
Sonatype Nexus Repository 3 allows an unauthenticated remote attacker to supply attacker-controlled input to a Java class loading call through an ExtDirect endpoint. This allows the attacker to learn whether specific classes are present in the application. The issue does not by itself allow code execution.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 50% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NR
Nexus Repository 3 · Sonatype
3.0.0 before 3.97.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-97666
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-97666
help.sonatype.com
https://help.sonatype.com/en/sonatype-nexus-repository-3-97-0-release-notes.html
support.sonatype.com
https://support.sonatype.com/hc/en-us/articles/56206649520147/
More from Nexus Repository 3
9.8
CVE-2019-7238
Sonatype Nexus Repository Manager Incorrect Access Control Vulnerability
9.8
CVE-2026-5189
Nexus Repository 3 - Hardcoded Credential in Internal Database Component
9.8
CVE-2019-9629
Sonatype Nexus Repository Manager before 3.17.0 establishes a default administrator user with weak defaults (fixed credentials)
9.8
CVE-2017-17717
Sonatype Nexus Repository Manager through 2.14.5 has weak password encryption with a hardcoded CMMDwoV value in the LDAP integration feature
8.8
CVE-2026-17600
Nexus Repository 3 - Session Not Invalidated on User Account Deletion or Deactivation