CVE-2026-9177
A critical flaw in Axway SecureTransport lets administrators inject and run arbitrary Java code when sending emails. The vulnerability is a server‑side template injection that can give an attacker full control of the host. It affects all versions before 5.5‑20260528.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Axway SecureTransport, versions earlier than 5.5‑20260528, used by organizations that rely on secure email transport.
Real-world impact
An attacker with administrative access could execute any code on the server, leading to complete compromise of the host, theft of data, and disruption of services.
Why this severity
The CVSS score of 9.4 reflects that the flaw requires high privileges but allows an attacker to run arbitrary code with high impact on confidentiality, integrity, and availability.
What to do about it
- 01Upgrade Axway SecureTransport to version 5.5‑20260528 or later.
NVD description indicates update 5.5‑20260528 is the fix.
Timeline
- Jul 29, 2026 · 22h agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 29, 2026 · 21h agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.