Biztalk360 versions prior to 11.5 suffer from an access control vulnerability that permits any user to request loading of a DLL file. Because the application calls a method during DLL loading, an attacker can upload a malicious DLL and achieve remote code execution on the server. This vulnerability is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type) and has a CVSS 3.1 base score of 8.8, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability. No patch or official remediation level has been published yet.

Successful exploitation results in remote code execution on the Biztalk360 server, potentially allowing an attacker to fully compromise the affected system. This impacts confidentiality, integrity, and availability of the server and any data or processes managed by Biztalk360. The vulnerability requires only user interaction and no privileges, making it relatively easy to exploit if an attacker can upload a malicious DLL.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the Biztalk360 server to trusted users only and monitor for unauthorized file uploads. Avoid exposing the application to untrusted networks or users. Follow vendor communications closely for updates on patches or mitigations.