CVE-2026-97666: 
Sonatype Nexus 3 vulnerability analysis and mitigation

CVE-2026-97666 is an unsafe reflection vulnerability in Sonatype Nexus Repository 3 that allows an unauthenticated remote attacker to supply attacker-controlled input to a Java class loading call through an ExtDirect endpoint, enabling enumeration of classes present in the application. It affects all versions from 3.0.0 up to (but not including) 3.97.0. The vulnerability was published on October 15, 2026, with a patch available in version 3.97.0 released October 14, 2026. It carries a CVSS v4.0 base score of 6.9 (Medium) (GitHub Advisory, Sonatype Release Notes).

The root cause is classified as CWE-470 (Use of Externally-Controlled Input to Select Classes or Code — 'Unsafe Reflection'), where the application passes attacker-supplied input directly into a Java class loading call without sufficient validation. The vulnerable attack surface is an ExtDirect endpoint accessible without authentication over the network, requiring no privileges, user interaction, or special attack conditions. By probing this endpoint with crafted class names, an attacker can perform a class oracle attack — determining which Java classes are loaded in the application's runtime environment — which can be used to fingerprint the application stack and identify potentially exploitable libraries. The vulnerability does not by itself enable code execution (GitHub Advisory).

The primary impact is a low-severity confidentiality disclosure: an unauthenticated attacker can enumerate which Java classes are present in the Nexus Repository 3 application, effectively mapping the application's internal architecture and dependency landscape. This information can be leveraged as reconnaissance to identify vulnerable libraries or gadget chains that could be used in follow-on attacks (e.g., deserialization exploits). There is no direct impact on integrity or availability, and no evidence that the vulnerability alone enables data exfiltration or service disruption (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation at the time of disclosure. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. However, the attack is automatable and requires no authentication, making it trivially scriptable for reconnaissance purposes. NVD SSVC assessment notes the exploitation status as 'none' (GitHub Advisory).

1. Reconnaissance: Identify internet-facing Sonatype Nexus Repository 3 instances (versions 3.0.0–3.96.x) using tools like Shodan or Censys by searching for Nexus Repository banners or known UI paths.
2. Locate the ExtDirect endpoint: Identify the unauthenticated ExtDirect API endpoint exposed by the Nexus Repository application (typically accessible at a known API path without requiring authentication).
3. Craft class-probing requests: Send HTTP requests to the ExtDirect endpoint with attacker-controlled input specifying Java class names (e.g., known deserialization gadget classes such as org.apache.commons.collections.Transformer or com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl).
4. Analyze responses: Observe the application's response to determine whether the specified class is present (e.g., different error messages or response codes for found vs. not-found classes), building a map of the application's loaded class inventory.
5. Identify attack surface: Use the enumerated class list to identify potentially exploitable libraries or gadget chains for use in subsequent, more impactful attacks (GitHub Advisory).

• Network: Unusual or repeated HTTP requests to the Nexus Repository ExtDirect endpoint from a single IP or automated source, particularly with varying class name parameters in the request body.
• Logs: Nexus Repository access logs showing high-frequency requests to the ExtDirect API path with no corresponding authenticated session; requests containing Java class name strings (e.g., org.apache, com.sun, java.lang) as parameter values.
• Logs: Application error logs showing repeated class-not-found or reflection-related exceptions triggered by external input.

Sonatype has addressed this vulnerability in Nexus Repository 3.97.0, released October 14, 2026; upgrading to this version or later is the recommended remediation (Sonatype Release Notes, GitHub Advisory). As a workaround for organizations unable to upgrade immediately, restrict network access to the ExtDirect endpoint via firewall rules or reverse proxy configuration to limit exposure to trusted networks only. Additionally, monitor access logs for anomalous probing activity targeting the ExtDirect endpoint.