Sonatype Nexus Repo 3 Java Class-Loading Leak via ExtDirect
CVE-2026-97666 Published on October 15, 2026

Nexus Repository 3 - Unsafe Reflection in ExtDirect Repository Endpoint
Sonatype Nexus Repository 3 allows an unauthenticated remote attacker to supply attacker-controlled input to a Java class loading call through an ExtDirect endpoint. This allows the attacker to learn whether specific classes are present in the application. The issue does not by itself allow code execution.

Vendor Advisory NVD

Vulnerability Analysis

CVE-2026-97666 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
NONE

Weakness Type

What is a Reflection Injection Vulnerability?

The application uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code. If the application uses external inputs to determine which class to instantiate or which method to invoke, then an attacker could supply values to select unexpected classes or methods. If this occurs, then the attacker could create control flow paths that were not intended by the developer. These paths could bypass authentication or access control checks, or otherwise cause the application to behave in an unexpected manner. This situation becomes a doomsday scenario if the attacker can upload files into a location that appears on the application's classpath (CWE-427) or add new entries to the application's classpath (CWE-426). Under either of these conditions, the attacker can use reflection to introduce new, malicious behavior into the application.

CVE-2026-97666 has been classified to as a Reflection Injection vulnerability or weakness.


Products Associated with CVE-2026-97666

Want to know whenever a new CVE is published for Sonatype Nexus Repository Manager? stack.watch will email you.

Sonatype Nexus Repository Manager
 

Affected Versions

Sonatype Nexus Repository 3: