CVE-2026-9177

Published: Lug 29, 2026 Last Modified: Lug 30, 2026
ExploitDB:
Other exploit source:
Google Dorks:
CRITICAL 9,4
Source: 1c6b5737-9389-4011-8117-89fa251edfb2
Attack Vector: network
Attack Complexity: low
Privileges Required: high
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A

Description

AI Translation Available

A Server-Side Template Injection (SSTI) vulnerability was identified
in the mail template functionality of the Axway SecureTransport product in version 5.5-20260326. This
flaw
allows an attacker with admin privileges to inject arbitrary Java code expressions, which are
executed server-side when the template is rendered (i.e., during email
sending). Successful exploitation of this flaw allows an attacker to
execute
arbitrary code on the server that results in full host compromise.

This issue affects all Axway SecureTransport versions prior 5.5-20260528 update.

1336

Improper Neutralization of Special Elements Used in a Template Engine

Incomplete
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Integrity
Potential Impacts:
Execute Unauthorized Code Or Commands
Applicable Platforms
Languages: Java, PHP, Python, JavaScript, Interpreted
Technologies: Not Technology-Specific, AI/ML, Client Server
View CWE Details
https://docs.hackjiji.org/blog/cve-2026-9177-ssti-in-secure…
https://docs.hackjiji.org/blog/cve-2026-9177-ssti-in-securetransport-mft-gateway
https://support.axway.com/news/4882/lang/en
https://support.axway.com/news/4882/lang/en
https://www.toreon.com/CVE-2026-9177
https://www.toreon.com/CVE-2026-9177