CVE-2026-9177

Received Received - Intake

Server-Side Template Injection in Axway SecureTransport

Publication date: 2026-07-29

Last updated on: 2026-07-29

Assigner: Toreon

Description

A Server-Side Template Injection (SSTI) vulnerability was identified in the mail template functionality of the Axway SecureTransport product in version 5.5-20260326. This flaw allows an attacker with admin privileges to inject arbitrary Java code expressions, which are executed server-side when the template is rendered (i.e., during email sending). Successful exploitation of this flaw allows an attacker to execute arbitrary code on the server that results in full host compromise. This issue affects all Axway SecureTransport versions prior 5.5-20260528 update.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-29

Last Modified

2026-07-29

Generated

2026-07-30

AI Q&A

2026-07-30

EPSS Evaluated

N/A

NVD

CVE-2026-9177

Affected Vendors & Products

Vendor	Product	Version / Range
axway	securetransport	to 5.5-20260528 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1336	The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.

Attack-Flow Graph

Executive Summary

This is a Server-Side Template Injection (SSTI) vulnerability in Axway SecureTransport version 5.5-20260326. An attacker with admin privileges can inject arbitrary Java code expressions into mail templates. When these templates are rendered during email sending, the injected code executes on the server, allowing full host compromise.

Impact Analysis

If you use Axway SecureTransport versions prior to 5.5-20260528, an attacker with admin access could exploit this to execute arbitrary code on your server. This could lead to data theft, system damage, unauthorized access, or disruption of services.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR and HIPAA requirements for data protection and confidentiality. Non-compliance may result in legal penalties, fines, or reputational damage.

Mitigation Strategies

Apply the latest Axway SecureTransport update (version 5.5-20260528 or later) to patch the SSTI vulnerability. Ensure admin privileges are restricted and review mail template configurations for suspicious code.

Hi! I’m here to help you understand CVE-2026-9177. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70