Axway vulnerabilities

Products

• SecureTransport 3
• email firewall 1
• file tranfer direct 1
• secure messenger 1
• vordel xml gateway 1

Latest Axway CVEs

Newest publication first

1. CVE-2026-9177 Server-Side Template Injection in SecureTransport's Apache Velocity mail templates

   Published 2026-07-29

   Critical·CVSS 9.4 EPSS 0.50%

   A Server-Side Template Injection (SSTI) vulnerability was identified in the mail template functionality of the Axway SecureTransport product in version 5.5-20260326. This flaw allows an attacker with admin privileges to inject arbitrary Java code expressions, which are executed s...

2. CVE-2015-5606 Vordel XML Gateway (acquired by Axway) version 7.2.2 could allow remote attackers to cause a denial of service via a specially crafted request.

   Published 2019-04-03

   High·CVSS 7.5 EPSS 1.7%

   Vordel XML Gateway (acquired by Axway) version 7.2.2 could allow remote attackers to cause a denial of service via a specially crafted request.

3. CVE-2019-6500 In Axway File Transfer Direct 2.7.1, an unauthenticated Directory Traversal vulnerability can be exploited by issuing a specially crafted HTTP GET request with %2e instead of '.' characters, as demons...

   Published 2019-01-21

   High·CVSS 7.5 EPSS 4.1%

   In Axway File Transfer Direct 2.7.1, an unauthenticated Directory Traversal vulnerability can be exploited by issuing a specially crafted HTTP GET request with %2e instead of '.' characters, as demonstrated by an initial /h2hdocumentation//%2e%2e/ substring.

4. CVE-2013-7057 Cross-site request forgery (CSRF) vulnerability in Axway SecureTransport 5.1 SP2 and earlier allows remote attackers to hijack the authentication of unspecified users for requests that upload arbitrar...

   Published 2014-11-04

   Medium·CVSS 6.8 EPSS 1.4%

   Cross-site request forgery (CSRF) vulnerability in Axway SecureTransport 5.1 SP2 and earlier allows remote attackers to hijack the authentication of unspecified users for requests that upload arbitrary files via a crafted request to api/v1.0/files/.

5. CVE-2012-6452 Axway Secure Messenger before 6.5 Updated Release 7, as used in Axway Email Firewall, provides different responses to authentication requests depending on whether the user exists, which allows remote....

   Published 2014-05-27

   Medium·CVSS 5.0 EPSS 1.5%

   Axway Secure Messenger before 6.5 Updated Release 7, as used in Axway Email Firewall, provides different responses to authentication requests depending on whether the user exists, which allows remote attackers to enumerate users via a series of requests.

6. CVE-2012-4991 Multiple directory traversal vulnerabilities in Axway SecureTransport 5.1 SP2 and earlier allow remote authenticated users to (1) read, (2) delete, or (3) create files, or (4) list directories, via a....

   Published 2012-12-13

   High·CVSS 8.5 EPSS 4.6% Public exploit

   Multiple directory traversal vulnerabilities in Axway SecureTransport 5.1 SP2 and earlier allow remote authenticated users to (1) read, (2) delete, or (3) create files, or (4) list directories, via a ..%5C (encoded dot dot backslash) in a URI.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.