CVE-2026-97666: Nexus Repository 3 Information Disclosure

CVE-2026-97666 Overview

CVE-2026-97666 affects Sonatype Nexus Repository 3, allowing an unauthenticated remote attacker to supply attacker-controlled input to a Java class loading call via an ExtDirect endpoint. The flaw enables attackers to determine whether specific Java classes are present in the running application. The vulnerability does not permit code execution by itself, but class enumeration can inform follow-on attacks against known gadget chains or vulnerable dependencies. The weakness is categorized under CWE-470: Use of Externally-Controlled Input to Select Classes or Code, commonly referred to as unsafe reflection.

Critical Impact
Unauthenticated attackers can remotely fingerprint the Java class environment of a Nexus Repository 3 instance, aiding targeted exploitation of other vulnerabilities.

Affected Products

Sonatype Nexus Repository 3 (versions prior to 3.97.0)
Deployments exposing the ExtDirect endpoint to untrusted networks
Both OSS and Pro editions as covered by the vendor advisory

Discovery Timeline

2026-10-15 - CVE-2026-97666 published to the National Vulnerability Database (NVD)
2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-97666

Vulnerability Analysis

The vulnerability resides in an ExtDirect endpoint exposed by Sonatype Nexus Repository 3. ExtDirect is a remoting protocol that maps HTTP requests to server-side method calls. One such handler accepts user-supplied input and passes it to a Java class loading routine without adequate validation. An attacker observes differentiated responses based on whether the requested class can be resolved by the Java ClassLoader. This yields a boolean oracle for class presence across the application and its dependencies. The issue is reachable without authentication, which broadens the attack surface to any network-accessible instance.

Root Cause

The root cause is improper validation of externally-controlled input used in a reflective class resolution call, consistent with [CWE-470]. The endpoint trusts request parameters when selecting classes, violating the principle of restricting reflective APIs to a known allow list.

Attack Vector

Exploitation requires only network reachability to the Nexus Repository 3 web interface. The attacker issues crafted HTTP requests to the vulnerable ExtDirect endpoint, iterating candidate class names. By comparing error signatures, response bodies, or status codes, the attacker infers which classes are loadable. The resulting class inventory supports reconnaissance for deserialization gadget chains, outdated libraries, or secondary vulnerabilities that may be chained for higher impact.

No verified public proof-of-concept code is available at the time of writing. See the Sonatype Support Article and Sonatype Nexus Repository Release Notes for official technical details.

Detection Methods for CVE-2026-97666

Indicators of Compromise

Repeated HTTP POST requests to ExtDirect endpoints (typically paths containing /service/extdirect) from a single source
Requests containing variable Java class name strings (for example, java.*, org.apache.*, com.sun.*)
Response patterns that differ based on supplied class values, often with distinctive error payloads
Unauthenticated sessions enumerating API handlers in rapid sequence

Detection Strategies

Inspect reverse-proxy and application logs for high-volume ExtDirect requests from the same client IP
Correlate anomalous ExtDirect traffic with absence of a valid authenticated session cookie
Build web application firewall (WAF) rules that flag ExtDirect payloads carrying fully qualified Java class names
Alert on scanning behavior where response size varies with the class name parameter

Monitoring Recommendations

Enable verbose logging on the Nexus Repository front-end and ship logs to a centralized analytics platform
Baseline normal ExtDirect call volume and alert on deviations
Monitor egress and authentication telemetry for post-reconnaissance activity targeting identified classes
Track Sonatype advisories for related chained vulnerabilities disclosed against the same endpoint

How to Mitigate CVE-2026-97666

Immediate Actions Required

Upgrade Sonatype Nexus Repository 3 to version 3.97.0 or later as described in the vendor release notes
Restrict network exposure of the Nexus Repository management interface to trusted administrative networks
Place the application behind an authenticating reverse proxy or VPN where feasible
Review access logs for prior enumeration attempts against ExtDirect endpoints

Patch Information

Sonatype addressed the issue in Nexus Repository 3.97.0. Refer to the Sonatype Nexus Repository 3.97.0 Release Notes and the Sonatype Support Article for upgrade guidance and verification steps.

Workarounds

Block or rate-limit unauthenticated requests to ExtDirect URIs at the WAF or reverse proxy layer
Enforce IP allow-listing for administrative endpoints until patching is complete
Require authentication at the proxy tier for all Nexus Repository paths, including API endpoints
Audit for anonymous access configurations and disable where not strictly necessary

bash

# Example NGINX reverse-proxy snippet to restrict ExtDirect to internal networks
location ~* /service/extdirect {
    allow 10.0.0.0/8;
    allow 192.168.0.0/16;
    deny  all;
    proxy_pass http://nexus_backend;
}