---
id: CVE-2026-97666
title: >-
  Sonatype Nexus Repository 3 allows an unauthenticated remote attacker to
  supply attacker-controlled input to a Java class loading call through an
  ExtDirect endpoint
summary: >-
  Sonatype Nexus Repository 3 allows an unauthenticated remote attacker to
  supply attacker-controlled input to a Java class loading call through an
  ExtDirect endpoint. This allows the attacker to learn whether specific classes
  are present …
severity: medium
cvss: 6.9
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'
cwe:
  - CWE-470
vendor: Sonatype
product: Nexus Repository 3
affected:
  - nexus_repository_3 >= 3.0.0 < 3.97.0
published: '2026-10-15'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T17:17:33.677'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-97666'
references:
  - url: >-
      https://help.sonatype.com/en/sonatype-nexus-repository-3-97-0-release-notes.html
    label: 103e4ec9-0a87-450b-af77-479448ddef11
  - url: 'https://support.sonatype.com/hc/en-us/articles/56206649520147/'
    label: 103e4ec9-0a87-450b-af77-479448ddef11
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-15T16:11:03.463175Z'
cvssSource: cna
ingestedAt: '2026-10-15T16:13:11.157Z'
---

## Overview

Sonatype Nexus Repository 3 allows an unauthenticated remote attacker to supply attacker-controlled input to a Java class loading call through an ExtDirect endpoint. This allows the attacker to learn whether specific classes are present in the application. The issue does not by itself allow code execution.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.