{"id":"CVE-2026-9177","aliases":["EUVD-2026-50331","GHSA-gqhf-wf6p-pjv9"],"status":"published","title":"Server-Side Template Injection in SecureTransport's Apache Velocity mail templates","description":"A Server-Side Template Injection (SSTI) vulnerability was identified \nin the mail template functionality of the Axway SecureTransport product in version 5.5-20260326. This \nflaw \nallows an attacker with admin privileges to inject arbitrary Java code expressions, which are \nexecuted server-side when the template is rendered (i.e., during email \nsending). Successful exploitation of this flaw allows an attacker to \nexecute \narbitrary code on the server that results in full host compromise.\n\n\n\nThis issue affects all Axway SecureTransport versions prior 5.5-20260528 update.","severity":{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00501,"percentile":0.43188,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-1336"],"published":"2026-07-29T13:46:06Z","modified":"2026-10-23T23:10:00Z","products":[{"vendor":"axway","product":"securetransport"}],"references":[{"url":"https://support.axway.com/news/4882/lang/en","tags":["vendor-advisory","mitigation","patch","customer-entitlement"]},{"url":"https://www.toreon.com/CVE-2026-9177","tags":["technical-description"]},{"url":"https://docs.hackjiji.org/blog/cve-2026-9177-ssti-in-securetransport-mft-gateway","tags":["technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9177"},{"url":"https://github.com/advisories/GHSA-gqhf-wf6p-pjv9"}],"sources":{"cve":[{"id":"CVE-2026-9177","title":"Server-Side Template Injection in SecureTransport's Apache Velocity mail templates","description":"A Server-Side Template Injection (SSTI) vulnerability was identified \nin the mail template functionality of the Axway SecureTransport product in version 5.5-20260326. This \nflaw \nallows an attacker with admin privileges to inject arbitrary Java code expressions, which are \nexecuted server-side when the template is rendered (i.e., during email \nsending). Successful exploitation of this flaw allows an attacker to \nexecute \narbitrary code on the server that results in full host compromise.\n\n\n\nThis issue affects all Axway SecureTransport versions prior 5.5-20260528 update.","status":"published","published":"2026-07-29T13:46:06.383Z","modified":"2026-07-31T05:52:15.529Z","cvss":[{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical","assessor":"cna"}],"cwes":["CWE-1336"],"updated_at":"2026-11-02T13:42:37.965383Z"}],"euvd":[{"id":"EUVD-2026-50331","description":"A Server-Side Template Injection (SSTI) vulnerability was identified \nin the mail template functionality of the Axway SecureTransport product in version 5.5-20260326. This \nflaw \nallows an attacker with admin privileges to inject arbitrary Java code expressions, which are \nexecuted server-side when the template is rendered (i.e., during email \nsending). Successful exploitation of this flaw allows an attacker to \nexecute \narbitrary code on the server that results in full host compromise.\n\n\n\nThis issue affects all Axway SecureTransport versions prior 5.5-20260528 update.","status":"published","published":"2026-07-29T13:46:06Z","modified":"2026-07-31T05:52:15Z","cvss":[{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical"}],"updated_at":"2026-11-02T18:02:26.304051Z"}],"ghsa":[{"id":"GHSA-gqhf-wf6p-pjv9","title":"A Server-Side Template Injection (SSTI) vulnerability was identified \nin the mail template...","description":"A Server-Side Template Injection (SSTI) vulnerability was identified \nin the mail template functionality of the Axway SecureTransport product in version 5.5-20260326. This \nflaw \nallows an attacker with admin privileges to inject arbitrary Java code expressions, which are \nexecuted server-side when the template is rendered (i.e., during email \nsending). Successful exploitation of this flaw allows an attacker to \nexecute \narbitrary code on the server that results in full host compromise.\n\n\n\nThis issue affects all Axway SecureTransport versions prior 5.5-20260528 update.","status":"published","published":"2026-07-29T15:31:12Z","modified":"2026-07-29T15:31:19Z","cvss":[{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical"}],"cwes":["CWE-1336"],"updated_at":"2026-11-02T15:09:54.335538Z"}],"nvd":[{"id":"CVE-2026-9177","description":"A Server-Side Template Injection (SSTI) vulnerability was identified \nin the mail template functionality of the Axway SecureTransport product in version 5.5-20260326. This \nflaw \nallows an attacker with admin privileges to inject arbitrary Java code expressions, which are \nexecuted server-side when the template is rendered (i.e., during email \nsending). Successful exploitation of this flaw allows an attacker to \nexecute \narbitrary code on the server that results in full host compromise.\n\n\n\nThis issue affects all Axway SecureTransport versions prior 5.5-20260528 update.","status":"published","published":"2026-07-29T14:16:35.857Z","modified":"2026-10-23T23:10:00.157Z","cvss":[{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical","assessor":"secondary"}],"cwes":["CWE-1336"],"updated_at":"2026-11-02T14:12:33.629616Z"}]}}