CVEvulnerability

CVE-2026-97666

6.9 MEDIUM Published 2026-10-15 Modified 2026-10-16 Official page ↗
Status
Awaiting Analysis
Published
2026-10-15
Last modified
2026-10-16
Assigner
103e4ec9-0a87-450b-af77-479448ddef11
CVSS 4.0 (103e4ec9-0a87-450b-af77-479448ddef11)
6.9 MEDIUM — CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weaknesses
CWE-470

Description

Sonatype Nexus Repository 3 allows an unauthenticated remote attacker to supply attacker-controlled input to a Java class loading call through an ExtDirect endpoint. This allows the attacker to learn whether specific classes are present in the application. The issue does not by itself allow code execution.

Related

Weakness · CWE (1)

  • CWE-470 Use of Externally-Controlled Input to Select Classes or Code weakness

References