Nexus Repository 3 CVE-2026-97665

Exploitation requires a hosted NuGet repository with the Symbol Server feature explicitly enabled - this is the key enabling precondition and is not a default for all repositories. The actor must possess repository read and browse privileges (CVSS PR:L); where anonymous access is enabled, the built-in anonymous user satisfies this by default, removing the need for a valid account. The flaw is limited to the .snupkg symbol-package upload path and yields an integrity-only outcome (unauthorized persistence of content), not read access to existing artifacts or service disruption. Limiting factors: Symbol Server must be on, the repository must be hosted (not proxy/group), and exploitation without credentials depends on anonymous access being enabled.

The vendor-supplied CVSS 4.0 score is 7.1 (High), driven entirely by an integrity impact (VI:H) with no confidentiality or availability consequence (VC:N/VA:N) and no scope change to subsequent systems. The vector is favorable to an attacker in most respects - network reachable (AV:N), low complexity (AC:L), no attack requirements (AT:N), and no user interaction (UI:N) - but it correctly requires low privileges (PR:L), reflecting that the actor must hold repository read and browse rights. That privilege requirement is materially weakened by the description's note that, where anonymous access is enabled, the built-in anonymous user holds read and browse across all repositories by default, which would make exploitation effectively unauthenticated against such deployments. No EPSS score, CISA KEV listing, or public POC was provided in the intelligence set, and no SSVC decision data was supplied, so exploitation-probability and automatability signals are absent and cannot be asserted. This is best treated as a moderate, patch-promptly priority rather than an emergency: the authorization bypass is concrete and the fix is available, but the impact is confined to writing/persisting symbol packages (an integrity-only effect) rather than data theft or service disruption, and there is no evidence of active exploitation at time of analysis. Note the gating precondition - Symbol Server must be enabled on a hosted NuGet repository - which narrows the real exposed population below the full Nexus install base.

An attacker with only read/browse rights (or the anonymous user, where anonymous access is enabled) targets a hosted NuGet repository that has Symbol Server turned on. Using the NuGet Components API upload path, they submit a .snupkg symbol package that the server accepts and persists despite the actor lacking write permission, planting unauthorized or malicious symbol content that downstream developers may later retrieve. No public exploit code was identified in the provided data.