CVE-2026-97666CWE-470

CVE-2026-97666

published October 15, 2026

CVSS
6.9
EPSS
1%
Percentile
45.3
In the wild
Unconfirmed
What it is

Sonatype Nexus Repository 3 allows an unauthenticated remote attacker to supply attacker-controlled input to a Java class loading call through an ExtDirect endpoint. This allows the attacker to learn whether specific classes are present in the application. The issue does not by itself allow code execution.

The record
Technical detail
CVSS
6.9 · NONE
CVSS v4.0
6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00551 · 45.3th percentile
Weakness
CWE-470 · Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
Published
2026-10-15T20:18Z
References (2)
https://help.sonatype.com/en/sonatype-nexus-repository-3-97-0-release-notes.html · 103e4ec9-0a87-450b-af77-479448ddef11https://support.sonatype.com/hc/en-us/articles/56206649520147/ · 103e4ec9-0a87-450b-af77-479448ddef11
EPSS history
Timeline
  • 17 OCT 03:34Z
    EPSS moved — → 1%
    epss
  • 15 OCT 15:34Z
    Nexus Repository 3 - Unsafe Reflection in ExtDirect Repository Endpoint
    cvelistv5
  • 15 OCT 15:34Z
    Nexus Repository 3 - Unsafe Reflection in ExtDirect Repository Endpoint
    cvelistv5