CVE-2026-97665

What it is

A missing authorization check in Nexus Repository 3's NuGet Components API upload path allows an account holding only repository read and browse privileges to upload and persist NuGet symbol packages (.snupkg) to a hosted repository, bypassing the write-permission check enforced for ordinary package uploads. Exploitation requires a hosted NuGet repository with Symbol Server enabled. If anonymous access is enabled, the built-in anonymous user holds read and browse privileges across all repositories by default, so this precondition can also be met without an authenticated account.

At a glance

Exploitability

Can be exploited over the network with a low-privilege account. High risk of data tampering.

Exploit odds

0.3% chance of exploitation in the next 30 days (EPSS).

Fix

No patch or advisory is linked yet. Look at mitigations or restrict exposure.

Timeline

1. 2026-09-24 20:12 UTC ReservedThe CVE id was reserved by its CNA
2. 2026-10-15 16:18 UTC PublishedDisclosed publicly on CVE.org and NVD
3. 2026-10-16 19:55 UTC Last updatedMost recent change to the record

Details

Published

2026-10-15 16:18 UTC

Last modified

2026-10-16 19:55 UTC

Exploit probability

0.3% · EPSS, next 30 days

Weakness

CWE-862 · Missing authorization

Record status

Awaiting Analysis

Attack profile CVSS 4.0 · 7.1

Attack vector

Network

Complexity

Low

Attack requirements

None

Privileges needed

Low

User interaction

None

Confidentiality

None

Integrity

High

Availability

None