CVE-2026-97665
7.1HighPublished 15 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- High impact on integrity
- Weakness
- CWE-862
Impact
Attackers can upload and overwrite NuGet symbol packages (.snupkg) to hosted repositories without write privileges. They only need read and browse permissions, which anonymous users have by default if anonymous access is enabled.
Root cause
The NuGet Components API upload handler omits write authorization checks when handling symbol package uploads to repositories with Symbol Server enabled.
Affected systems
Nexus Repository 3 prior to 3.97.0 (exact affected starting versions not listed — check the vendor advisory).
CVSS v4.0 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Fix & remediation
Upgrade to Nexus Repository 3.97.0 or later. If patching immediately is not possible, disable Symbol Server on all hosted NuGet repositories or disable anonymous access to prevent unauthenticated uploads.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A missing authorization check in Nexus Repository 3's NuGet Components API upload path allows an account holding only repository read and browse privileges to upload and persist NuGet symbol packages (.snupkg) to a hosted repository, bypassing the write-permission check enforced for ordinary package uploads. Exploitation requires a hosted NuGet repository with Symbol Server enabled. If anonymous access is enabled, the built-in anonymous user holds read and browse privileges across all repositories by default, so this precondition can also be met without an authenticated account.