The vulnerability in Sonatype Nexus Repository 3 allows an unauthenticated remote attacker to provide attacker‑controlled input to a Java class‑loading call exposed through an ExtDirect endpoint. By sending specially crafted requests, the attacker can determine whether specific classes exist within the application. Although this does not lead directly to remote code execution, it reveals internal application structure, which can aid subsequent attacks or persistence strategies. The weakness corresponds to CWE‑470, reflecting unsafe reflection usage.

All deployed instances of Sonatype Nexus Repository 3 from version 3.0.0 up through 3.96.4 are affected. Any installation with the ExtDirect interface enabled is vulnerable unless it has been upgraded past these releases.

The vulnerability carries a CVSS score of 6.9, indicating a moderate impact. The EPSS score of < 1% suggests that exploitation is unlikely at present. The issue is not listed in CISA’s KEV catalog, further indicating limited widespread exploitation. Attackers can trigger the flaw from any network location that can reach the ExtDirect endpoint, requiring no authentication. The primary risk is informational, providing potential attackers with insight into the application’s class landscape.