CVE-2026-97665: 
Sonatype Nexus 3 vulnerability analysis and mitigation

CVE-2026-97665 is a missing authorization vulnerability in Sonatype Nexus Repository 3's NuGet Components API upload path that allows accounts with only read and browse privileges to upload and persist NuGet symbol packages (.snupkg) to hosted repositories, bypassing write-permission checks. It affects Nexus Repository 3 versions 3.95.0 through 3.96.x (fixed in 3.97.0), and was disclosed on October 15, 2026. The vulnerability carries a CVSS v4.0 base score of 7.1 (High) (GitHub Advisory, Sonatype Release Notes).

The root cause is classified as CWE-862 (Missing Authorization): the NuGet Components API upload path for symbol packages (.snupkg) does not enforce the same write-permission check applied to ordinary NuGet package uploads. An attacker exploiting this flaw only needs network access and an account with repository read and browse privileges — or no account at all if anonymous access is enabled, since the built-in anonymous user is granted read and browse privileges across all repositories by default. Exploitation additionally requires that the target hosted NuGet repository has the Symbol Server feature enabled (GitHub Advisory, Sonatype Release Notes).

Successful exploitation allows an attacker to inject arbitrary NuGet symbol packages (.snupkg) into hosted repositories, which are then served to downstream package consumers. This creates a supply chain integrity risk: developers and build systems consuming packages from the affected repository may receive malicious debug symbols, potentially enabling symbol-based attacks or facilitating further compromise of developer workstations and CI/CD pipelines. Confidentiality and availability of the repository itself are not directly impacted, but the integrity of the artifact supply chain is significantly undermined (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation at the time of disclosure (GitHub Advisory). The EPSS score is 0.0, reflecting a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the attack complexity is low and, when anonymous access is enabled, exploitation requires no authentication whatsoever, lowering the barrier for opportunistic abuse.

1. Reconnaissance: Identify Nexus Repository 3 instances running versions 3.95.0–3.96.x, using network scanning tools (e.g., Shodan, Censys) or by probing the /service/rest/v1/status API endpoint to confirm the version.
2. Check for anonymous access: Attempt to browse the repository without credentials. If anonymous access is enabled, no authentication is needed; otherwise, obtain or use any low-privilege account with read and browse permissions on a hosted NuGet repository.
3. Identify target repository: Enumerate hosted NuGet repositories with Symbol Server enabled via the Nexus Repository API (/service/rest/v1/repositories) or the web UI.
4. Craft malicious .snupkg: Prepare a NuGet symbol package (.snupkg) containing malicious or tampered debug symbols for a legitimate package name present in the repository.
5. Upload via NuGet Components API: Submit the .snupkg file to the NuGet Components API upload endpoint (e.g., PUT /service/rest/v1/components?repository=<repo-name>) using standard NuGet tooling or a direct HTTP request, bypassing the write-permission check.
6. Persistence and delivery: The malicious symbol package is persisted in the repository and served to any consumer that requests debug symbols for the targeted package, enabling downstream compromise (GitHub Advisory).

• Network: Unexpected HTTP PUT or POST requests to NuGet Components API upload endpoints (e.g., /service/rest/v1/components) from low-privilege or anonymous accounts, particularly uploading .snupkg files.
• Logs: Nexus Repository access logs showing .snupkg upload activity from accounts that do not hold write privileges, or from the anonymous user; audit log entries recording component uploads to hosted NuGet repositories without corresponding write-role assignments.
• File System: Presence of unexpected or unrecognized .snupkg files in hosted NuGet repository blob storage directories that do not correspond to packages uploaded by authorized users.
• Repository: New or modified NuGet symbol packages in hosted repositories that were not published through normal CI/CD pipelines or authorized workflows.

Upgrade Sonatype Nexus Repository 3 to version 3.97.0 or later, which contains the fix for this authorization bypass (Sonatype Release Notes). If immediate upgrade is not possible, apply the following mitigations: disable anonymous access to the repository to prevent unauthenticated exploitation; restrict read and browse privileges to only trusted, known users; and disable the Symbol Server feature on hosted NuGet repositories if symbol serving is not required. Review audit logs for any unauthorized .snupkg uploads that may have occurred on affected versions.