FKIE_CVE-2026-9177

Vulnerability from fkie_nvd - Published: 2026-07-29 14:16 - Updated: 2026-07-30 20:27
Severity
9.4 (Critical) - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Summary
A Server-Side Template Injection (SSTI) vulnerability was identified in the mail template functionality of the Axway SecureTransport product in version 5.5-20260326. This flaw allows an attacker with admin privileges to inject arbitrary Java code expressions, which are executed server-side when the template is rendered (i.e., during email sending). Successful exploitation of this flaw allows an attacker to execute arbitrary code on the server that results in full host compromise. This issue affects all Axway SecureTransport versions prior 5.5-20260528 update.
References
1c6b5737-9389-4011-8117-89fa251edfb2https://docs.hackjiji.org/blog/cve-2026-9177-ssti-in-securetransport-mft-gateway
1c6b5737-9389-4011-8117-89fa251edfb2https://support.axway.com/news/4882/lang/en
1c6b5737-9389-4011-8117-89fa251edfb2https://www.toreon.com/CVE-2026-9177
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "affected",
          "packageName": "Apache Velocity",
          "product": "SecureTransport",
          "vendor": "Axway",
          "versions": [
            {
              "lessThan": "5.5-20260528",
              "status": "affected",
              "version": "5.5-20260326",
              "versionType": "SecureTransport"
            }
          ]
        }
      ],
      "source": "1c6b5737-9389-4011-8117-89fa251edfb2"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A Server-Side Template Injection (SSTI) vulnerability was identified \nin the mail template functionality of the Axway SecureTransport product in version 5.5-20260326. This \nflaw \nallows an attacker with admin privileges to inject arbitrary Java code expressions, which are \nexecuted server-side when the template is rendered (i.e., during email \nsending). Successful exploitation of this flaw allows an attacker to \nexecute \narbitrary code on the server that results in full host compromise.\n\n\n\nThis issue affects all Axway SecureTransport versions prior 5.5-20260528 update."
    }
  ],
  "id": "CVE-2026-9177",
  "lastModified": "2026-07-30T20:27:10.763",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 9.4,
          "baseSeverity": "CRITICAL",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "HIGH",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "HIGH",
          "subConfidentialityImpact": "HIGH",
          "subIntegrityImpact": "HIGH",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "HIGH",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "1c6b5737-9389-4011-8117-89fa251edfb2",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-9177",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-07-29T14:48:04.009422Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-07-29T14:16:35.857",
  "references": [
    {
      "source": "1c6b5737-9389-4011-8117-89fa251edfb2",
      "url": "https://docs.hackjiji.org/blog/cve-2026-9177-ssti-in-securetransport-mft-gateway"
    },
    {
      "source": "1c6b5737-9389-4011-8117-89fa251edfb2",
      "url": "https://support.axway.com/news/4882/lang/en"
    },
    {
      "source": "1c6b5737-9389-4011-8117-89fa251edfb2",
      "url": "https://www.toreon.com/CVE-2026-9177"
    }
  ],
  "sourceIdentifier": "1c6b5737-9389-4011-8117-89fa251edfb2",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-1336"
        }
      ],
      "source": "1c6b5737-9389-4011-8117-89fa251edfb2",
      "type": "Secondary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.