Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.4

Axway SecureTransport mail templates allow malicious code execution

CVE-2026-9177 · published 3 months ago
Summary

A security issue in Axway SecureTransport's mail templates allows an attacker with admin privileges to execute arbitrary code on the server. This could result in the attacker gaining full control of the server. To protect your system, apply the latest security update for Axway SecureTransport version 5.5-20260528 or later.

What to do
  • Update axway securetransport to version 5.5-20260528 or later.
Affected software
VendorProductAffected versions
axway securetransport < 5.5-20260528
Original advisory text
A Server-Side Template Injection (SSTI) vulnerability was identified in the mail template functionality of the Axway SecureTransport product in version 5.5-20260326. This flaw allows an attacker...
A Server-Side Template Injection (SSTI) vulnerability was identified
in the mail template functionality of the Axway SecureTransport product in version 5.5-20260326. This
flaw
allows an attacker with admin privileges to inject arbitrary Java code expressions, which are
executed server-side when the template is rendered (i.e., during email
sending). Successful exploitation of this flaw allows an attacker to
execute
arbitrary code on the server that results in full host compromise.



This issue affects all Axway SecureTransport versions prior 5.5-20260528 update.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
9.4 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-1336Improper Neutralization of Special Elements Used in a Template Engine
Timeline
Published29 Jul 2026
Updated7 Nov 2026
First seen29 Jul 2026
Sources
CVE-2026-9177 · NVD
CVE-2026-9177 · MITRE
Track software like this
Free during beta