CVE-2026-9177
Server-Side Template Injection in SecureTransport's Apache Velocity mail templates
- Published
- Updated
- Reserved
- Assigned by
- Toreon
Description
A Server-Side Template Injection (SSTI) vulnerability was identified in the mail template functionality of the Axway SecureTransport product in version 5.5-20260326. This flaw allows an attacker with admin privileges to inject arbitrary Java code expressions, which are executed server-side when the template is rendered (i.e., during email sending). Successful exploitation of this flaw allows an attacker to execute arbitrary code on the server that results in full host compromise. This issue affects all Axway SecureTransport versions prior 5.5-20260528 update.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| ToreonCNA (assigner) | 4.0 | Critical9.4 | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H |
| NVDNVD · Awaiting Analysis | 4.0 | Critical9.4 | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
- EPSS (exploitation in 30 days)
- 0.50% · top 57% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: total
The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.4.
Weakness
Affected products
- affected 5.5-20260326 – < 5.5-20260528
References (3)
- https://support.axway.com/news/4882/lang/en (opens in a new tab)vendor-advisorymitigationpatchcustomer-entitlement
- https://www.toreon.com/CVE-2026-9177 (opens in a new tab)technical-description
- https://docs.hackjiji.org/blog/cve-2026-9177-ssti-in-securetransport-mft-gateway (opens in a new tab)technical-description
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2026-9177)Record last updated .