Nexus Repository 3 CVE-2026-17595

Exploitation requires an authenticated account that has been explicitly granted the nexus:selectors:create permission - this is not a default permission and must be assigned by an administrator. The vulnerable feature is the Content Selector creation interface within Nexus Repository 3. The sandbox prevents method invocation and object construction, so exploitation is strictly limited to reading JVM class metadata properties; there is no path to code execution through this vulnerability alone. No special network position, operating system, or non-default deployment configuration is required beyond possession of the nexus:selectors:create permission. Limiting factors: non-default permission assignment gates access; disclosed data (class/classloader names) has no direct exploitation utility without a separate chained vulnerability.

The CVSS 4.0 score of 5.3 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N) is a reasonable representation of real-world risk. Network access is required but so is an authenticated account with the specific nexus:selectors:create permission, which is not assigned by default and must be explicitly granted by an administrator - this meaningfully limits the realistic attack surface. Confidentiality impact is low and bounded: only JVM class and classloader names are exposed, not credentials, repository artifacts, or secrets. There is no integrity or availability impact. No EPSS score was provided, and absent KEV listing or known POC, exploitation probability is assessed as low. The 'RCE' intelligence tag in the input data is contradicted by the vendor description and should be disregarded; this is a sandbox property-read escape, not code execution. Real-world priority is low for most organizations: the combination of required authenticated access, a specific non-default permission, and severely limited disclosure impact makes this a low-urgency patch rather than an emergency response item.

An authenticated Nexus Repository 3 user with the nexus:selectors:create permission creates a Content Selector containing a crafted JEXL expression that traverses Java object property chains - for example, referencing .class or .classLoader properties - to extract JVM class and classloader names from the expression evaluation context. The disclosed metadata could assist an attacker in fingerprinting the JVM environment or identifying additional internal class structure to support a chained attack, though this CVE itself provides no execution capability. No public POC has been identified at time of analysis.