Nexus Repository 3 CVE-2026-97666

No special conditions - remote unauthenticated exploitation against default configurations of Sonatype Nexus Repository 3, reachable through its ExtDirect endpoint (AV:N/AC:L/PR:N/UI:N). The key LIMITING factor is impact, not reachability: successful exploitation only reveals whether specific Java classes are present in the application and does not grant code execution, file access, or data modification. Exposure is further bounded to instances running affected versions prior to the 3.97.0 fix and reachable on the network/interface where the ExtDirect endpoint is served.

This is a genuine but modest-severity information-disclosure flaw, not a critical issue despite the 'RCE' tag applied in the input (the description explicitly states it 'does not by itself allow code execution', so the RCE tag is misleading). The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms remote, low-complexity, unauthenticated reachability with no user interaction - attractive characteristics - but impact is capped at VC:L/VI:N/VA:N, i.e. an attacker can only learn whether specific Java classes are loadable, which is reconnaissance value rather than direct compromise. No EPSS score, CISA KEV listing, or public POC is present in the supplied data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net: prioritize patching because the product is a high-value CI/CD target and the flaw is unauthenticated, but treat it as an enumeration/recon primitive that may be chained with other bugs rather than a standalone high-risk RCE. Signals are internally consistent except for the contradictory 'RCE' tag versus the description - defer to the description and CWE-470 (unsafe class selection).

An unauthenticated attacker on the network sends crafted input to the Nexus Repository 3 ExtDirect endpoint that controls a Java class-loading call, then observes the response to determine whether a named class exists in the running application. No public exploit is identified in the provided data; the technique serves as reconnaissance to fingerprint installed libraries, plugins, or versions, potentially informing a later chained attack. It does not itself yield code execution or data extraction beyond class-presence inference.