An incorrect access control bug in BizTalk360 versions earlier than 11.5 enables any user to request the loading of a DLL file. The system then calls a method within that DLL during loading, allowing an attacker to craft a malicious DLL, upload it, and execute arbitrary code on the server. This results in full compromise of confidentiality, integrity, and availability on the affected host.

The vulnerability affects Kovai’s BizTalk360 product prior to version 11.5. All installations of BizTalk360 before that release are susceptible, regardless of build or patch level.

With a CVSS score of 8.8, the issue is rated as high severity. The EPSS score of less than 1% indicates that exploit likelihood is currently low, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be local or network‑based, as the vulnerability permits any user—authenticated or otherwise—to trigger the DLL loading process, provided they can reach the vulnerable endpoint. An attacker would need to upload a crafted DLL through the exposed interface and then invoke the load operation to execute the payload.