CVE-2026-9177 Server-Side Template Injection in SecureTransport's Apache Velocity mail templates
An admin can inject Java code into mail templates to execute arbitrary code on the server, leading to full host compromise.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-9177?
CVE-2026-9177 is a critical code injection vulnerability in Axway SecureTransport, published on 29 Jul 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A Server-Side Template Injection (SSTI) vulnerability was identified in the mail template functionality of the Axway SecureTransport product in version 5.5-20260326. This flaw allows an attacker with admin privileges to inject arbitrary Java code expressions, which are executed server-side when the template is rendered (i.e., during email sending). Successful exploitation of this flaw allows an attacker to execute arbitrary code on the server that results in full host compromise.
This issue affects all Axway SecureTransport versions prior 5.5-20260528 update.
Weakness: CWE-1336
Which versions are affected by CVE-2026-9177?
How do I fix CVE-2026-9177?
No fix has been published for CVE-2026-9177 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-9177 being exploited?
There is no known exploitation of CVE-2026-9177 in the wild and no public exploit code.
Sources
Also known as GHSA-gqhf-wf6p-pjv9.