This vulnerability in Biztalk360 (up to version 11.5) arises from improper sanitization of user input in file path handling, enabling a directory traversal attack. A Super User with elevated privileges can leverage this flaw to read arbitrary files on the server or coerce authentication from the service. The CVSS 3.1 vector indicates the attack requires network access, low attack complexity, and high privileges, with no user interaction needed. The impact is primarily confidentiality loss without affecting integrity or availability.

An attacker with Super User privileges can read sensitive files on the affected system or coerce authentication, potentially exposing confidential information. The vulnerability does not affect system integrity or availability. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Super User access to trusted personnel only and monitor for unusual file access patterns related to Biztalk360. Avoid exposing the service to untrusted networks if possible.