CVE-2026-9177

A Server-Side Template Injection (SSTI) vulnerability was identified in the mail template functionality of the Axway SecureTransport product in version 5.5-20260326. This flaw allows an attacker with admin privileges to inject arbitrary Java code expressions, which are executed server-side when the template is rendered (i.e., during email sending). Successful exploitation of this flaw allows an attacker to execute arbitrary code on the server that results in full host compromise. This issue affects all Axway SecureTransport versions prior 5.5-20260528 update.

CVSS

No CVSS.

References

Link	Resource
https://docs.hackjiji.org/blog/cve-2026-9177-ssti-in-securetransport-mft-gateway
https://support.axway.com/news/4882/lang/en
https://www.toreon.com/CVE-2026-9177

Configurations

No configuration.

History

29 Jul 2026, 14:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-07-29 14:16

Updated : 2026-07-30 20:27

NVD link : CVE-2026-9177

Mitre link : CVE-2026-9177

CVE.ORG link : CVE-2026-9177

JSON object : View

Products Affected

No product.

CWE

CWE-1336

Improper Neutralization of Special Elements Used in a Template Engine

{"id": "CVE-2026-9177", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-9177", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-29T14:48:04.009422Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "1c6b5737-9389-4011-8117-89fa251edfb2", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.4, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "1c6b5737-9389-4011-8117-89fa251edfb2", "affectedData": [{"vendor": "Axway", "product": "SecureTransport", "versions": [{"status": "affected", "version": "5.5-20260326", "lessThan": "5.5-20260528", "versionType": "SecureTransport"}], "packageName": "Apache Velocity", "defaultStatus": "affected"}]}], "published": "2026-07-29T14:16:35.857", "references": [{"url": "https://docs.hackjiji.org/blog/cve-2026-9177-ssti-in-securetransport-mft-gateway", "source": "1c6b5737-9389-4011-8117-89fa251edfb2"}, {"url": "https://support.axway.com/news/4882/lang/en", "source": "1c6b5737-9389-4011-8117-89fa251edfb2"}, {"url": "https://www.toreon.com/CVE-2026-9177", "source": "1c6b5737-9389-4011-8117-89fa251edfb2"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "1c6b5737-9389-4011-8117-89fa251edfb2", "description": [{"lang": "en", "value": "CWE-1336"}]}], "descriptions": [{"lang": "en", "value": "A Server-Side Template Injection (SSTI) vulnerability was identified \nin the mail template functionality of the Axway SecureTransport product in version 5.5-20260326. This \nflaw \nallows an attacker with admin privileges to inject arbitrary Java code expressions, which are \nexecuted server-side when the template is rendered (i.e., during email \nsending). Successful exploitation of this flaw allows an attacker to \nexecute \narbitrary code on the server that results in full host compromise.\n\n\n\nThis issue affects all Axway SecureTransport versions prior 5.5-20260528 update."}], "lastModified": "2026-07-30T20:27:10.763", "sourceIdentifier": "1c6b5737-9389-4011-8117-89fa251edfb2"}