This vulnerability in Next4Biz CRM & BPM Software's BPM module (versions 6.6.4.4 prior to 6.6.4.5) involves improper control over code generation, enabling remote code inclusion (CWE-94). The flaw allows unauthenticated attackers to inject and execute arbitrary code remotely, posing a critical security risk. The CVSS 3.1 base score is 9.8, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. No official fix or mitigation details are currently available from the vendor, and the product is not cloud-hosted, so remediation depends on vendor patch release.

Successful exploitation could lead to remote code execution, allowing attackers to execute arbitrary commands on the affected system. This compromises confidentiality, integrity, and availability of the BPM software and potentially the underlying host. Given the critical CVSS score of 9.8, the impact is severe and could result in full system compromise or disruption of business processes managed by the software.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary workaround is currently documented, users should monitor Next4Biz vendor communications closely. Until a patch is available, consider restricting network access to the BPM software to trusted users and environments to reduce exposure.