SEPTEMBER 9, 2026
Live Feed
Back to database
Case File

CVE-2026-59864

CRITICAL · CVSS 9.3 EPSS 1.27% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-07-16 · Last synced 2026-08-15

CyberRota Analysis

AI-Generated

The vulnerability affects the Kiota OpenAPI-based HTTP Client code generator in versions prior to 1.32.5, where the `kiota plugin add` and `kiota plugin generate` commands improperly handle attacker-controlled static_template.file values. This flaw allows for path traversal or out-of-package file inclusion in Microsoft 365 Copilot and Teams plugin manifests, potentially leading to unauthorized file access or execution. Organizations utilizing Kiota for plugin development should prioritize updating to version 1.32.5 to mitigate these risks.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-59864
Severity
CRITICAL
CVSS
9.3
EPSS
1.27%
Microsoft Windows

Original NVD Description

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.5, `kiota plugin add` and `kiota plugin generate` (with `-t APIPlugin`) emitted attacker-controlled static_template.file values from x-ai-adaptive-card and x-ai-capabilities into generated Microsoft 365 Copilot and Teams plugin manifests without path validation, allowing ../, absolute, rooted, UNC, Windows drive, or URI paths in response_semantics.static_template.file to cause path traversal or out-of-package file inclusion when the generated plugin was deployed. This issue is fixed in version 1.32.5.