Sonatype Nexus Repository 3 version 3.15.0 contained a vulnerability (CVE-2026-17595) due to incomplete sandboxing of JEXL expressions in Content Selectors. An attacker with the nexus:selectors:create permission could craft expressions that accessed Java object properties beyond the intended scope, disclosing internal JVM class metadata including class and classloader names. This exposure of sensitive system information is classified under CWE-497. The vulnerability does not permit execution of methods, object creation, or arbitrary code execution. The fix involves restricting property access within the JEXL sandbox to only the intended data types.

The vulnerability allows an attacker with limited permissions (nexus:selectors:create) to disclose sensitive internal JVM metadata such as class and classloader names. This information disclosure could aid an attacker in further reconnaissance but does not directly allow code execution or modification of system state.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vendor has indicated the issue has been fixed by restricting property access in the JEXL sandbox, but no explicit patch or remediation level is provided in the available data. Users should monitor Sonatype advisories for an official fix and apply it once available. Until then, restrict the nexus:selectors:create permission to trusted users only.