CVE-2026-9177

Server-Side Template Injection in SecureTransport's Apache Velocity mail templates

Assigner: Toreon
Reserved: 21.05.2026 Published: 29.07.2026 Updated: 31.07.2026

A Server-Side Template Injection (SSTI) vulnerability was identified in the mail template functionality of the Axway SecureTransport product in version 5.5-20260326. This flaw allows an attacker with admin privileges to inject arbitrary Java code expressions, which are executed server-side when the template is rendered (i.e., during email sending). Successful exploitation of this flaw allows an attacker to execute arbitrary code on the server that results in full host compromise.

This issue affects all Axway SecureTransport versions prior 5.5-20260528 update.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CVSS Score: 9.4

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Network	Confidentiality	High	Confidentiality	High
Attack Complexity	Low	Integrity	High	Integrity	High
Attack Requirements	None	Availability	High	Availability	High
Privileges Required	High
User Interaction	None

CVSS 4.0

Product Status

Vendor	Axway
Product	SecureTransport
Versions	Default: affected affected from 5.5-20260326 to 5.5-20260528 (excl.)

Vendor

Axway

Product

SecureTransport

Versions

Default: affected

affected from 5.5-20260326 to 5.5-20260528 (excl.)

References

Problem Types

CWE-1336 Improper neutralization of special elements used in a template engine CWE

Impacts