A critical Server-Side Template Injection vulnerability in Netaxis API Orchestrator allows unauthenticated attackers to execute arbitrary code on the host system.

This is a Server-Side Template Injection (SSTI) flaw that allows an unauthenticated attacker to inject malicious template directives. The vulnerability stems from improper handling of user-supplied input within the templating engine.

The CVSS score of 9.8 reflects the high risk of total system compromise. Successful exploitation allows for unauthorized data access, modification of system configurations, and potential full control over the underlying server infrastructure, leading to significant operational disruption and data loss.

Immediate Action: Upgrade Netaxis API Orchestrator (APIO) to version 0.19.3 or later immediately.

Proactive Monitoring: Monitor server logs for unusual HTTP requests containing common template expression characters (e.g., ${}, {{}}, <% %>).

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SSTI payload patterns.

Public Exploit Available: Unknown.

Given the critical CVSS severity and the existence of proof-of-concept material, organizations must prioritize patching to version 0.19.3. Immediate action is required to eliminate the risk of remote command execution by unauthenticated actors.