Quick answers
- Is CVE-2025-59710 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2025-59710 being exploited in the wild.
- How severe is CVE-2025-59710?
- High severity, with a CVSS score of 8.8, published 3 April 2026.
- Which products and versions are affected?
- Kovai.co BizTalk360 < 11.6.3963.2611.
- Is there a fix for CVE-2025-59710?
- A patch was published on 2025-08-18: Initial fix in version 11.5 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2025-59710 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2025-59710?
- Check whether you run Kovai Biztalk360. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A vulnerability exists in BizTalk360 due to missing authorization checks in several WCF service endpoints. Specifically, the 'ValidateNotificationChannel' endpoint in the AlertServiceManagement class fails to invoke 'ApiSecurityHelper' for permission validation, allowing any authenticated user to specify a DLL path. Because the application also exposes an unrestricted file upload endpoint ('/UploadFile' in AnalyticsDataService), an attacker can upload a malicious DLL and then trigger its execution by providing its path to the vulnerable loading service. If the uploaded assembly implements the 'IChannelNotification' interface, it is instantiated upon loading, resulting in remote code execution (RCE) with the privileges of the service account. This issue is fixed in version 11.6.3963.2611.
Affected products
- Kovai.co BizTalk360 < 11.6.3963.2611
Timeline
- 2025-06-27: other: First contact with vendor
- 2025-08-18: patched: Initial fix in version 11.5
- 2025-12-03: patched: Final fix in version 11.6.3963.2611 released
- 2026-04-03: disclosed: Public advisory released