Which versions of Axway SecureTransport are affected by CVE-2026-9177?

Axway SecureTransport faces a critical remote code execution vulnerability (CVSS 9.4) that enables complete server compromise through mail template injection, affecting all versions before…. A patch is available.

How to fix or mitigate CVE-2026-9177?

Immediate actions (24 hours): Identify all Axway SecureTransport instances and document their current versions, audit and document all users with administrative access, enable enhanced logging for mail template modifications and administrative actions, and restrict admin access to essential personnel only. Within 7 days: Conduct a complete vulnerability assessment of all Axway instances, implement or verify network segmentation to isolate SecureTransport from other systems, establish real-time monitoring for unauthorized template changes, and document baseline configurations for comparison. Within 30 days: Continuously monitor Axway vendor advisories for patch release (no vendor-released patch identified at time of analysis); prepare immediate deployment procedures for when a patch becomes available; conduct security awareness training focused on credential protection and social engineering for administrative users.

Axway SecureTransport CVE-2026-9177

Q: What is the CVSS score of CVE-2026-9177?

CVE-2026-9177 has a CVSS 4.0 base score of 9.4 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-50331 CRITICAL

Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)

2026-07-29 Toreon

GHSA-gqhf-wf6p-pjv9

RCE Java Ssti Securetransport Axway

9.4

CVSS 4.0 · Vendor: Toreon

Severity by source

Vendor (Toreon) PRIMARY

9.4 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.1 CRITICAL

Network-reachable admin console (AV:N) with low complexity, but requires administrator privileges (PR:H); code execution escapes the app to compromise the host (S:C) with full C/I/A impact.

3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (Toreon).

CVSS VectorVendor: Toreon

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 29, 2026 - 15:02 EUVD

Analysis Generated

Jul 29, 2026 - 14:20 vuln.today

CVE Published

Jul 29, 2026 - 13:46 cve.org

CRITICAL 9.4

DescriptionCVE.org

A Server-Side Template Injection (SSTI) vulnerability was identified in the mail template functionality of the Axway SecureTransport product in version 5.5-20260326. This flaw allows an attacker with admin privileges to inject arbitrary Java code expressions, which are executed server-side when the template is rendered (i.e., during email sending). Successful exploitation of this flaw allows an attacker to execute arbitrary code on the server that results in full host compromise.

This issue affects all Axway SecureTransport versions prior 5.5-20260528 update.

Articles & Coverage 1

News Critical RCE in Axway SecureTransport Java Templates - CVE-2026-9177 Jul 29, 2026

AnalysisAI

Authenticated remote code execution in Axway SecureTransport (all versions prior to 5.5-20260528, confirmed present in 5.5-20260326) allows an administrator to inject Java expressions into mail templates that are evaluated server-side when emails are rendered and sent, resulting in full host compromise. The flaw is a Server-Side Template Injection (CWE-1336) reported by Toreon and fixed by Axway; no public exploit identified at time of analysis, though a technical write-up and vendor advisory exist. Because exploitation requires admin privileges (CVSS 4.0 PR:H), risk is bounded to trusted or compromised administrative accounts despite the 9.4 severity.

Technical ContextAI

SecureTransport is Axway's managed file transfer (MFT) gateway used to broker secure B2B and internal file exchange, typically deployed at the network edge. The vulnerable component is its mail/notification template engine, which renders administrator-defined templates (e.g. for event and transfer notifications) using a Java-based templating mechanism. CWE-1336 (Improper Neutralization of Special Elements Used in a Template Engine) describes the root cause: template input is passed to an evaluator that resolves embedded expressions rather than treating them as inert text, so an attacker who controls template content can embed Java expression-language constructs that the engine executes in the server JVM context during rendering. The affected CPE is cpe:2.3:a:axway:securetransport:*:*:*:*:*:*:*:*, and the tags (Java, SSTI, RCE) confirm the language and exploitation class.

RemediationAI

Vendor-released patch: upgrade Axway SecureTransport to the 5.5-20260528 update or later, per the vendor advisory at https://support.axway.com/news/4882/lang/en, which is the definitive fix. Until patching is possible, reduce the attack surface by tightly restricting who holds SecureTransport administrator privileges and by enforcing multi-factor authentication and IP-allowlisting on the administration interface so the template feature is not reachable by untrusted or internet-based actors - the trade-off is added operational friction for admin logins. Additionally, audit and lock down mail/notification template configuration to a minimal set of trusted operators and review existing templates for unexpected Java expression content; note this does not remove the underlying flaw and only limits opportunity, so it must not substitute for applying the update. Refer to the Toreon write-up (https://www.toreon.com/CVE-2026-9177) for exploitation specifics when validating mitigations.