CVE-2026-9177

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-9177", "assignerOrgId": "1c6b5737-9389-4011-8117-89fa251edfb2", "state": "PUBLISHED", "assignerShortName": "Toreon", "dateReserved": "2026-05-21T14:43:42.513Z", "datePublished": "2026-07-29T13:46:06.383Z", "dateUpdated": "2026-07-31T05:52:15.529Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1c6b5737-9389-4011-8117-89fa251edfb2", "shortName": "Toreon", "dateUpdated": "2026-07-31T05:52:15.529Z"}, "title": "Server-Side Template Injection in SecureTransport's Apache Velocity mail templates", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-1336", "description": "CWE-1336 Improper neutralization of special elements used in a template engine", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-242", "descriptions": [{"lang": "en", "value": "CAPEC-242 Code Injection"}]}], "affected": [{"vendor": "Axway", "product": "SecureTransport", "packageName": "Apache Velocity", "versions": [{"status": "affected", "version": "5.5-20260326", "lessThan": "5.5-20260528", "versionType": "SecureTransport"}], "defaultStatus": "affected"}], "descriptions": [{"lang": "en", "value": "A Server-Side Template Injection (SSTI) vulnerability was identified \nin the mail template functionality of the Axway SecureTransport product in version 5.5-20260326. This \nflaw \nallows an attacker with admin privileges to inject arbitrary Java code expressions, which are \nexecuted server-side when the template is rendered (i.e., during email \nsending). Successful exploitation of this flaw allows an attacker to \nexecute \narbitrary code on the server that results in full host compromise.\n\n\n\nThis issue affects all Axway SecureTransport versions prior 5.5-20260528 update.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>A Server-Side Template Injection (SSTI) vulnerability was identified \nin the mail template functionality of the Axway SecureTransport product in version 5.5-20260326. This \nflaw \nallows an attacker with admin privileges to inject arbitrary Java code expressions, which are \nexecuted server-side when the template is rendered (i.e., during email \nsending). Successful exploitation of this flaw allows an attacker to \nexecute \narbitrary code on the server that results in full host compromise.</p><p>This issue affects all Axway SecureTransport versions prior 5.5-20260528 update.</p>"}]}], "references": [{"url": "https://support.axway.com/news/4882/lang/en", "tags": ["vendor-advisory", "mitigation", "patch", "customer-entitlement"]}, {"url": "https://www.toreon.com/CVE-2026-9177", "tags": ["technical-description"]}, {"url": "https://docs.hackjiji.org/blog/cve-2026-9177-ssti-in-securetransport-mft-gateway", "tags": ["technical-description"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "CRITICAL", "baseScore": 9.4, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H"}}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.2"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-29T14:48:04.009422Z", "id": "CVE-2026-9177", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-29T14:48:13.505Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-9177", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-07-29T14:48:04.009422Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-29T14:48:09.647Z"}}], "cna": {"title": "Server-Side Template Injection in SecureTransport's Apache Velocity mail templates", "source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-242", "descriptions": [{"lang": "en", "value": "CAPEC-242 Code Injection"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.4, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Axway", "product": "SecureTransport", "versions": [{"status": "affected", "version": "5.5-20260326", "lessThan": "5.5-20260528", "versionType": "SecureTransport"}], "packageName": "Apache Velocity", "defaultStatus": "affected"}], "references": [{"url": "https://support.axway.com/news/4882/lang/en", "tags": ["vendor-advisory", "mitigation", "patch", "customer-entitlement"]}, {"url": "https://www.toreon.com/CVE-2026-9177", "tags": ["technical-description"]}, {"url": "https://docs.hackjiji.org/blog/cve-2026-9177-ssti-in-securetransport-mft-gateway", "tags": ["technical-description"]}], "x_generator": {"engine": "Vulnogram 1.0.2"}, "descriptions": [{"lang": "en", "value": "A Server-Side Template Injection (SSTI) vulnerability was identified \nin the mail template functionality of the Axway SecureTransport product in version 5.5-20260326. This \nflaw \nallows an attacker with admin privileges to inject arbitrary Java code expressions, which are \nexecuted server-side when the template is rendered (i.e., during email \nsending). Successful exploitation of this flaw allows an attacker to \nexecute \narbitrary code on the server that results in full host compromise.\n\n\n\nThis issue affects all Axway SecureTransport versions prior 5.5-20260528 update.", "supportingMedia": [{"type": "text/html", "value": "<p>A Server-Side Template Injection (SSTI) vulnerability was identified \nin the mail template functionality of the Axway SecureTransport product in version 5.5-20260326. This \nflaw \nallows an attacker with admin privileges to inject arbitrary Java code expressions, which are \nexecuted server-side when the template is rendered (i.e., during email \nsending). Successful exploitation of this flaw allows an attacker to \nexecute \narbitrary code on the server that results in full host compromise.</p><p>This issue affects all Axway SecureTransport versions prior 5.5-20260528 update.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1336", "description": "CWE-1336 Improper neutralization of special elements used in a template engine"}]}], "providerMetadata": {"orgId": "1c6b5737-9389-4011-8117-89fa251edfb2", "shortName": "Toreon", "dateUpdated": "2026-07-31T05:52:15.529Z"}}}, "cveMetadata": {"cveId": "CVE-2026-9177", "state": "PUBLISHED", "dateUpdated": "2026-07-31T05:52:15.529Z", "dateReserved": "2026-05-21T14:43:42.513Z", "assignerOrgId": "1c6b5737-9389-4011-8117-89fa251edfb2", "datePublished": "2026-07-29T13:46:06.383Z", "assignerShortName": "Toreon"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "affected", "packageName": "Apache Velocity", "product": "SecureTransport", "vendor": "Axway", "versions": [{"lessThan": "5.5-20260528", "status": "affected", "version": "5.5-20260326", "versionType": "SecureTransport"}]}], "source": "1c6b5737-9389-4011-8117-89fa251edfb2"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A Server-Side Template Injection (SSTI) vulnerability was identified \nin the mail template functionality of the Axway SecureTransport product in version 5.5-20260326. This \nflaw \nallows an attacker with admin privileges to inject arbitrary Java code expressions, which are \nexecuted server-side when the template is rendered (i.e., during email \nsending). Successful exploitation of this flaw allows an attacker to \nexecute \narbitrary code on the server that results in full host compromise.\n\n\n\nThis issue affects all Axway SecureTransport versions prior 5.5-20260528 update."}, {"lang": "es", "value": "Una vulnerabilidad de inyecci\u00f3n de plantillas del lado del servidor (SSTI) fue identificada en la funcionalidad de plantillas de correo del producto Axway SecureTransport en la versi\u00f3n 5.5-20260326. Esta falla permite a un atacante con privilegios de administrador inyectar expresiones de c\u00f3digo Java arbitrarias, las cuales son ejecutadas del lado del servidor cuando la plantilla es renderizada (es decir, durante el env\u00edo de correo electr\u00f3nico). La explotaci\u00f3n exitosa de esta falla permite a un atacante ejecutar c\u00f3digo arbitrario en el servidor, lo que resulta en el compromiso total del host.\n\nEste problema afecta a todas las versiones de Axway SecureTransport anteriores a la actualizaci\u00f3n 5.5-20260528."}], "id": "CVE-2026-9177", "lastModified": "2026-10-23T23:10:00.157", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.4, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "1c6b5737-9389-4011-8117-89fa251edfb2", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-9177", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-07-29T14:48:04.009422Z", "version": "2.0.3"}}]}, "published": "2026-07-29T14:16:35.857", "references": [{"source": "1c6b5737-9389-4011-8117-89fa251edfb2", "url": "https://docs.hackjiji.org/blog/cve-2026-9177-ssti-in-securetransport-mft-gateway"}, {"source": "1c6b5737-9389-4011-8117-89fa251edfb2", "url": "https://support.axway.com/news/4882/lang/en"}, {"source": "1c6b5737-9389-4011-8117-89fa251edfb2", "url": "https://www.toreon.com/CVE-2026-9177"}], "sourceIdentifier": "1c6b5737-9389-4011-8117-89fa251edfb2", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1336"}], "source": "1c6b5737-9389-4011-8117-89fa251edfb2", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[5.5-20260326,5.5-20260528)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "SecureTransport", "source": "cna", "vendor": "Axway"}, "product": "securetransport", "vendor": "axway"}], "created": "2026-07-29T15:45:03.852023+00:00", "updated": "2026-08-02T08:00:04.673717+00:00", "vendors": ["axway", "axway$PRODUCT$securetransport"]}