Read the docs
TI-2026-08066 Aliases CVE-2026-9177GHSA-gqhf-wf6p-pjv9

Server-Side Template Injection in SecureTransport's Apache Velocity mail templates

Priority MEDIUM 43CWE-1336Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-1336.

Summary

A Server-Side Template Injection (SSTI) vulnerability was identified in the mail template functionality of the Axway SecureTransport product in version 5.5-20260326. This flaw allows an attacker with admin privileges to inject arbitrary Java code expressions, which are executed server-side when the template is rendered (i.e., during email sending). Successful exploitation of this flaw allows an attacker to execute arbitrary code on the server that results in full host compromise. This issue affects all Axway SecureTransport versions prior 5.5-20260528 update.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00501 43rd percentileScored 2026-11-07
Fix Fixed SecureTransport (Axway): 5.5-20260528

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AxwaySecureTransport5.5-20260326 to before 5.5-202605285.5-20260528Patch availableCNA
  • SecureTransport VendorAxway Affected 5.5-20260326 to before 5.5-20260528 Fixed in 5.5-20260528 Patch available CNA

Remediation

  • Fix · CNA SecureTransport (Axway) Fixed in 5.5-20260528

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-9177
  2. 2026-10-03 Alias added: GHSA-gqhf-wf6p-pjv9

References

Patch 1

Other 2

  • TI-2019-10632 Axway SecureTransport 5.x through 5.3 (or 5.x through 5.5 with certain API configuration)… CVSS 3.1CRITICAL 9.8
  • TI-2012-04217 Multiple directory traversal vulnerabilities in Axway SecureTransport 5.1 SP2 and earlier… CVSS 2.0HIGH 8.5
  • TI-2019-04556 In Axway File Transfer Direct 2.7.1, an unauthenticated Directory Traversal vulnerability… CVSS 3.0HIGH 7.5
  • TI-2015-04724 Vordel XML Gateway (acquired by Axway) version 7.2.2 could allow remote attackers to… CVSS 3.0HIGH 7.5
  • TI-2013-05797 Cross-site request forgery (CSRF) vulnerability in Axway SecureTransport 5.1 SP2 and… CVSS 2.0MEDIUM 6.8
  • TI-2012-05194 Axway Secure Messenger before 6.5 Updated Release 7, as used in Axway Email Firewall… CVSS 2.0MEDIUM 5.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences