CVE-2026-17597 is a Server-Side Request Forgery (SSRF) vulnerability identified in Sonatype Nexus Repository 3. The flaw exists in the email configuration verification feature, where an authorized user (with nexus:settings:update permission) can supply arbitrary host and port values to the email test/verification endpoint. This causes the server to initiate outbound network connections to potentially internal or otherwise restricted network addresses. By analyzing differences in server responses, an attacker could infer the accessibility of internal hosts and ports. The vulnerability affects all Nexus Repository 3 CE/Pro versions from 3.0.0 up to and including 3.94.1 and was resolved in version 3.95.0.

An attacker with nexus:settings:update permission can exploit this SSRF vulnerability to cause the server to connect to internal or restricted network addresses. This may allow the attacker to perform network reconnaissance by inferring the reachability of internal hosts and ports. There is no indication of direct remote code execution or data exfiltration from this vulnerability. The CVSS score is 5.1 (medium severity), reflecting the limited scope and required privileges.

Upgrade Nexus Repository 3 to version 3.95.0 or later, where this SSRF vulnerability is fixed. Since the vulnerability requires the nexus:settings:update permission, restrict this permission to trusted users only as an additional mitigation. Patch status is confirmed fixed in 3.95.0.