Axway SecureTransport up to 5.5-20260527 Mail Template special elements used in a template engine

Summaryinfo

A vulnerability, which was classified as very critical, has been found in Axway SecureTransport up to 5.5-20260527. Affected by this vulnerability is an unknown functionality of the component Mail Template. This manipulation causes improper neutralization of special elements used in a template engine. This vulnerability is registered as CVE-2026-9177. Remote exploitation of the attack is possible. No exploit is available.

Detailsinfo

A vulnerability classified as very critical was found in Axway SecureTransport up to 5.5-20260527. Affected by this vulnerability is an unknown functionality of the component Mail Template. The manipulation with an unknown input leads to a improper neutralization of special elements used in a template engine vulnerability. The CWE definition for the vulnerability is CWE-1336. The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

A Server-Side Template Injection (SSTI) vulnerability was identified in the mail template functionality of the Axway SecureTransport product in version 5.5-20260326. This flaw allows an attacker with admin privileges to inject arbitrary Java code expressions, which are executed server-side when the template is rendered (i.e., during email sending). Successful exploitation of this flaw allows an attacker to execute arbitrary code on the server that results in full host compromise. This issue affects all Axway SecureTransport versions prior 5.5-20260528 update.

It is possible to read the advisory at support.axway.com. This vulnerability is known as CVE-2026-9177 since 05/21/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation requires an enhanced level of successful authentication. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 07/29/2026). The attack technique deployed by this issue is T1221 according to MITRE ATT&CK.

Upgrading to version 5.5-20260528 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• Axway

Name

• SecureTransport

Version

• 5.5-20260527

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion