CVE-2025-59710
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
In Biztalk360 before version 11.5, an access control issue allows any user to request loading a DLL file. During loading, a method is called. An attacker can craft a malicious DLL, upload it to the server, and use it to achieve remote code execution.
Risk Assessment
An attacker can remotely execute arbitrary code on the server, leading to full system compromise, data theft, or application takeover.
Recommendation
Upgrade Biztalk360 to version 11.5 or later, which contains the fix. As a temporary measure, restrict users' ability to upload DLL files.
Other vulnerabilities in Biztalk360
See all- CVE-2025-59711High
An issue was discovered in Biztalk360 before 11.5. Due to mishandling of user-provided input in an upload mechanism, an authenticated attacker is able to write files outside of the destination directory and/or coerce an authentication from the service, aka Directory Traversal.
- CVE-2025-59709Medium
In Biztalk360 through version 11.5, a Directory Traversal vulnerability exists due to mishandling of user-provided input in a path to be read by the server. A Super User attacker can read files on the system and/or coerce an authentication from the service.
Original NVD description (English source)
An issue was discovered in Biztalk360 before 11.5. Because of incorrect access control, any user is able to request the loading a DLL file. During the loading, a method is called. An attacker can craft a malicious DLL, upload it to the server, and use it to achieve remote code execution on the server.