CVE-2025-9868

8.7 highEPSS 0.5%

High (8.7). EPSS 0.5% chance of exploitation in the next 30 days.

Server-Side Request Forgery (SSRF) in the Remote Browser Plugin in Sonatype Nexus Repository 2.x up to and including 2.15.2 allows unauthenticated remote attackers to exfiltrate proxy repository credentials via crafted HTTP requests.

Severity

CVSS 4.0

8.7 high

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 42% of CVEs (scores of 2026-10-31)
CWE: CWE-918
Published: 2025-10-08
Modified: 2026-09-26
Record from: the NVD, synced 2026-10-19

References

https://support.sonatype.com/hc/en-us/articles/45363201583635

Check your stack JSON