CVE-2026-97665 Sonatype CVE debrief

Who should care

Defenders responsible for Nexus Repository 3 instances, especially those with hosted NuGet repositories and Symbol Server enabled, should assess exposure and prioritize remediation.

Why it matters

Defenders should care about CVE-2026-97665 because it allows unauthorized uploads of NuGet symbol packages to Nexus Repository 3 instances with hosted NuGet repositories and Symbol Server enabled, potentially leading to supply chain attacks. Roles responsible for managing Nexus Repository 3 instances and NuGet repositories should assess exposure and prioritize remediation. The vulnerability's impact is heightened if anonymous access is enabled, as the built-in anonymous user holds read and browse privileges by default. Evidence is limited to CVE and source item details; further verification is needed to determine affected versions and remediation steps.

• An attacker could upload malicious NuGet symbol packages to a hosted repository, potentially leading to supply chain attacks.
• The vulnerability allows unauthorized package uploads, bypassing normal write-permission checks.
• Defenders need to verify if their instances are affected and remediate as necessary to prevent potential exploitation.
• Inventory checks are necessary to determine if any accounts with repository read and browse privileges exist and could be exploited.

Technical summary

The vulnerability exists in the NuGet Components API upload path of Nexus Repository 3, allowing an account with repository read and browse privileges to upload NuGet symbol packages (.snupkg) without proper authorization. This allows unauthorized uploads of NuGet symbol packages to a hosted repository, potentially leading to supply chain attacks. Exploitation requires a hosted NuGet repository with Symbol Server enabled. If anonymous access is enabled, the built-in anonymous user holds read and browse privileges across all repositories by default.

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability in their Nexus Repository 3 instances, especially if they have hosted NuGet repositories with Symbol Server enabled.

Recommended defensive actions

• Verify if your Nexus Repository 3 instance has a hosted NuGet repository with Symbol Server enabled.
• Check if any accounts with repository read and browse privileges exist and assess their potential exposure.
• Consider upgrading to Nexus Repository 3 version 3.97.0 or later.
• Review and update access controls for NuGet symbol package uploads.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE record and source item provide details on the missing authorization check in Nexus Repository 3's NuGet Components API upload path. Evidence is limited to CVE and source item details; further verification is needed to determine affected versions and remediation steps. The vulnerability allows unauthorized package uploads, bypassing normal write-permission checks. Defenders need to verify if their instances are affected and remediate as necessary to prevent potential exploitation. Inventory checks are necessary to determine if

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.