Quick answers
- Is CVE-2025-59711 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2025-59711 being exploited in the wild.
- How severe is CVE-2025-59711?
- High severity, with a CVSS score of 8.3, published 3 April 2026.
- Which products and versions are affected?
- Kovai.co BizTalk360 < 11.6.3963.2611.
- Is there a fix for CVE-2025-59711?
- A patch was published on 2025-08-18: Version 11.5 released (partial fix) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2025-59711 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2025-59711?
- Check whether you run Kovai Biztalk360. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A directory traversal vulnerability exists in the upload mechanism of BizTalk360 due to improper validation of user-supplied input. Authenticated attackers can exploit this by providing manipulated file paths to write arbitrary files outside of the designated destination directory. When combined with other flaws in the application, such as the lack of access controls on sensitive service endpoints (e.g., /UploadFile in AnalyticsDataService), this can be used to upload and subsequently load malicious DLLs. The vulnerability is reachable over the network via WCF services and can be exploited by any authenticated domain account if the application is configured with Windows Authentication. A fix is available in version 11.6.3963.2611.
Affected products
- Kovai.co BizTalk360 < 11.6.3963.2611
Timeline
- 2025-06-27: other: First contact with vendor
- 2025-08-18: patched: Version 11.5 released (partial fix)
- 2025-12-03: patched: Version 11.6.3963.2611 released (full fix)
- 2026-04-03: disclosed: Public advisory released