Microsoft Kiota vulnerabilities

13 CVEs affecting Microsoft Kiota, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-105796, published 2026-10-06.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-59865, published 2026-07-16. Critical severity, CVSS 9.3. EPSS: 4.4% chance of exploitation in the next 30 days. Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, `kiota info` read x-ms-kiota-info.languagesInformation.<language>.dependencyInstallCommand plus dependency name and…
CVE-2026-59867, published 2026-07-16. High severity, CVSS 7.1. EPSS: 2.4% chance of exploitation in the next 30 days. Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, Kiota resolved OpenAPI $ref values by fetching remote http(s) URLs and reading local absolute or out-of-tree file…
CVE-2026-73851, published 2026-08-17. Medium severity, CVSS 6.1. EPSS: 2.3% chance of exploitation in the next 30 days. Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.34.0, an attacker who controls or tampers with the OpenAPI description consumed by Kiota can supply a file reference that…
CVE-2026-59861, published 2026-07-16. High severity, CVSS 7.5. EPSS: 2% chance of exploitation in the next 30 days. Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.0, Kiota's Ruby generator embedded OpenAPI default fields, property names, and other schema-derived strings through…
CVE-2026-59866, published 2026-07-16. Critical severity, CVSS 9.3. EPSS: 1.4% chance of exploitation in the next 30 days. Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, Kiota emitted x-ms-kiota-info clientClassName and clientNamespaceName values without identifier or path sanitization…
CVE-2026-59860, published 2026-07-16. High severity, CVSS 8.7. EPSS: 1.4% chance of exploitation in the next 30 days. Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.3, Kiota is affected by a code-generation injection vulnerability in the C# XML documentation-comment sink (the…
CVE-2026-59859, published 2026-07-16. High severity, CVSS 8.7. EPSS: 1.4% chance of exploitation in the next 30 days. Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.4, Kiota's PHP generator embedded OpenAPI description, default fields, property names, and other schema-derived strings…
CVE-2026-59862, published 2026-07-16. High severity, CVSS 7.5. EPSS: 1.4% chance of exploitation in the next 30 days. Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.0, Kiota's Python generator let attacker-controlled enum value descriptions from x-ms-enum.values[].description flow…
CVE-2026-59863, published 2026-07-16. High severity, CVSS 7.0. EPSS: 1.4% chance of exploitation in the next 30 days. Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, Kiota honored a poisoned .kiota/workspace.json workspace configuration without validating per-client or per-plugin…
CVE-2026-59864, published 2026-07-16. Critical severity, CVSS 9.3. EPSS: 1.3% chance of exploitation in the next 30 days. Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, `kiota plugin add` and `kiota plugin generate` (with `-t APIPlugin`) emitted attacker-controlled static_template.file…

Latest

CVE-2026-105796, published 2026-10-06. High severity, CVSS 8.8. EPSS: 0.9% chance of exploitation in the next 30 days. Kiota is an OpenAPI based HTTP Client code generator. From 0.5.0 until 1.35.0, Kiota's Java and PHP documentation-comment sanitizers delete block-comment terminators rather than neutralizing them,…
CVE-2026-105795, published 2026-10-06. Low severity, CVSS 3.1. EPSS: 1.2% chance of exploitation in the next 30 days. Kiota is an OpenAPI based HTTP Client code generator. From 1.25.1 until 1.35.0, Kiota copies x-ai-capabilities.response_semantics.oauth_card_path from an attacker-controlled or compromised OpenAPI…