High severityNVD Advisory· Published Oct 8, 2025· Updated Apr 15, 2026

CVE-2025-9868

Description

Server-Side Request Forgery (SSRF) in the Remote Browser Plugin in Sonatype Nexus Repository 2.x up to and including 2.15.2 allows unauthenticated remote attackers to exfiltrate proxy repository credentials via crafted HTTP requests.

Affected products

Sonatype/Nexus Repositoryllm-fuzzy
Range: <=2.15.2

Patches

Vulnerability mechanics

References

support.sonatype.com/hc/en-us/articles/45363201583635nvd

News mentions

No linked articles in our index yet.

cvss	0.455
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000