Sonatype Nexus Security Advisory
Date: October 15, 2026
Affected Versions: All previous Sonatype Nexus Repository 3 CE/Pro versions up to and including 3.96.x
Fixed in Version: Sonatype Nexus Repository 3 CE/Pro version 3.97.0
CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N = 6.9 (Medium)
CWE: CWE-470: Use of Externally-Controlled Input to Select Classes or Code
Sonatype Guide: https://guide.sonatype.com/vulnerability/CVE-2026-97666
Summary
A vulnerability in the ExtDirect readReferences endpoint of Sonatype Nexus Repository 3 allows an unauthenticated remote attacker to pass an arbitrary string to ClassLoader.loadClass() without validation. The endpoint has lacked authentication since Nexus Repository 3.0.0. An attacker can use this to determine whether a given class name is present in the Nexus Repository application classloader, producing a limited class-existence oracle. This vulnerability does not in isolation enable code execution, as loadClass() does not trigger class initialization or invoke static initializers in this code path.
At the time of this advisory, Sonatype is not aware of this vulnerability being actively exploited in the wild.
Recommendation
Users are advised to upgrade to Sonatype Nexus Repository 3 CE/Pro version 3.97.0 or later. Downloads are available at https://help.sonatype.com/en/download.html.
If an immediate upgrade is not possible, see the Immediate Mitigation Options section below.
Immediate Mitigation Options
There is no configuration change that fully mitigates this vulnerability without upgrading. The following measures reduce exposure:
- Network-level access control: Restrict access to the Nexus Repository web interface to trusted networks. This prevents unauthenticated attackers from reaching the affected endpoint.
-
Reverse proxy: If Nexus is deployed behind a reverse proxy, configure it to require authentication for requests to
/service/extdirectuntil the upgrade can be applied.
Credit
This issue was discovered and reported responsibly by wupco123 via Sonatype’s Bug Bounty Program.
Frequently Asked Questions
Q: What is the risk associated with this vulnerability?
A: An unauthenticated remote attacker can send crafted requests to the affected endpoint to determine whether specific class names are present in the Nexus Repository application classloader. This produces a limited class-existence oracle that can reveal which libraries and plugins are installed. The attacker cannot use this vulnerability alone to execute code, read arbitrary files, or modify data.
Q: What preconditions must be met in order to be vulnerable?
A: The attacker must have network access to the Nexus Repository web interface. No authentication is required. All supported configurations of Nexus Repository 3 CE/Pro are affected. The vulnerability has been present since version 3.0.0.
Q: Are there implications associated with this advisory itself?
A: Publishing this advisory may enable malicious actors to attempt to exploit this vulnerability. Affected users should assess their exposure and apply the recommended upgrade or interim mitigation as soon as practicable.
Q: Why is Sonatype making this information available?
A: Sonatype follows responsible disclosure practices. We coordinate with security researchers who report vulnerabilities to us in good faith, and we publish advisories after a fix is available so that users can take informed action to protect their installations.