CVE-2026-9177

CRITICAL

Server-Side Template Injection in SecureTransport's Apache Velocity mail templates

Title source: cna
STIX 2.1

Description

A Server-Side Template Injection (SSTI) vulnerability was identified in the mail template functionality of the Axway SecureTransport product in version 5.5-20260326. This flaw allows an attacker with admin privileges to inject arbitrary Java code expressions, which are executed server-side when the template is rendered (i.e., during email sending). Successful exploitation of this flaw allows an attacker to execute arbitrary code on the server that results in full host compromise. This issue affects all Axway SecureTransport versions prior 5.5-20260528 update.

References (3)

Core 3
Core References
Vendor Advisory vendor-advisory
https://support.axway.com/news/4882/lang/en
Technical Description technical-description
https://www.toreon.com/CVE-2026-9177

Scores

CVSS v4 9.4
EPSS 0.0029
EPSS Percentile 21.1%
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-1336
Status published
Products (1)
Axway/SecureTransport 5.5-20260326 - 5.5-20260528
Published Jul 29, 2026
Tracked Since Jul 29, 2026