Sonatype Nexus Repository 3.97.0 (15 Oct): four new CVEs, led by CVE-2026-97712 (CVSS 4.0 8.7) privilege escalation via role management; also NuGet symbol upload authz bypass (7.1), unauthenticated ExtDirect class oracle (6.9), and Browse UI stored XSS (5.1)

Sonatype published four CVE records for Nexus Repository 3 on 15 October 2026 and fixed them in Sonatype Nexus Repository 3 CE/Pro 3.97.0 (release notes dated mid-October; CVE references point at the 3.97.0 notes and matching support articles). CVE-2026-97712 (CVSS 4.0 8.7 High): a user who only holds role create or role update can grant roles and privileges the account does not hold, including full administrative access. CVE-2026-97665 (CVSS 4.0 7.1 High): a missing authorisation check on the NuGet Components API upload path lets an account with only repository read and browse privileges upload and persist NuGet symbol packages (.snupkg) to a hosted repository when Symbol Server is enabled; if anonymous access is on, the built-in anonymous user can hold those read/browse rights. CVE-2026-97666 (CVSS 4.0 6.9 Medium): an unauthenticated remote attacker can feed attacker-controlled input into a Java class-loading call through an ExtDirect repository endpoint and learn whether specific classes are present — information disclosure only, not code execution by itself. CVE-2026-97667 (CVSS 4.0 5.1 Medium): an account with edit permission on a hosted R repository can store script content in R package metadata that runs in the browser of anyone who opens that package in the Browse UI. Affected ranges differ by CVE (97712 and 97666 from 3.0.0; 97667 from 3.28.0; 97665 from 3.95.0) but all are fixed in 3.97.0. No exploitation is stated in the CVE records. Primary: Sonatype 3.97.0 release notes and support advisories; CVE.org records published 15 Oct.

Product

Sonatype Nexus Repository 3 (CE/Pro)

Versions

Fixed: 3.97.0. CVE-2026-97712 / CVE-2026-97666: affected from 3.0.0 before 3.97.0. CVE-2026-97667: affected from 3.28.0 before 3.97.0. CVE-2026-97665: affected from 3.95.0 before 3.97.0 (hosted NuGet with Symbol Server).

CVSS

8.7 (CVE-2026-97712, CVSS 4.0 High); also 7.1 (97665), 6.9 (97666), 5.1 (97667) — Sonatype/CVE records

Exploited in Australia?

unknown

Patch to

Upgrade Nexus Repository 3 CE/Pro to 3.97.0 or later. Until then: review who can create or update roles; disable anonymous access if you do not need it; turn off NuGet Symbol Server on hosted repos you do not use; and treat Browse UI package detail pages as untrusted input from repository writers.

Primary: Sonatype — Nexus Repository 3.97.0 release notes (fixes CVE-2026-97712 and related Oct 2026 advisories) · Vendor: Sonatype Support — Security Advisories (Nexus Repository 3) · CVE: CVE-2026-97712, CVE-2026-97665, CVE-2026-97666, CVE-2026-97667 · CVE.org — CVE-2026-97712 Nexus Repository 3 privilege escalation via role management (published 15 Oct 2026)

tech cloud