Microsoft Semantic Kernel — Critical RCE & Arbitrary File Write Chain (CVE-2026-26030, CVE-2026-25592)

Microsoft Semantic Kernel (TL-2026-0481), also tracked as Semantic Kernel RCE Chain, is a critical-severity software vulnerability scored CVSS 9.9, first published 2026-05-08. It has no confirmed attribution, affects Microsoft Semantic Kernel Python SDK, references 2 CVEs (CVE-2026-26030, CVE-2026-25592), maps to 25 MITRE ATT&CK techniques (T1005, T1027, T1041), and is covered by 9 detection rules and 26 indicators of compromise.

Key facts for TL-2026-0481

Threat ID
TL-2026-0481
Also known as
Semantic Kernel RCE Chain, GHSA-xjw9-4gw8-4rqx, GHSA-2ww3-72rp-wpp4
Severity
CRITICAL
CVSS
9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
Status
MONITORING
Category
VULNERABILITY
First published
2026-05-08
Last reviewed
2026-05-08
Attribution confidence
NONE
Motivation
UNKNOWN
Target sectors
technology, financial, healthcare, government, retail, manufacturing, professional-services, saas, ai-platform-providers
Target regions
Global, North America, Europe, Asia-Pacific
Detection rules
9
Indicators of compromise
26

Malware and tooling in Microsoft Semantic Kernel

Malware and tooling: Microsoft Semantic Kernel SDK

Two vendor-confirmed CRITICAL vulnerabilities (both CVSS 9.9, scope-changed) in Microsoft's Semantic Kernel — the AI agent orchestration SDK with 27.9k stars on GitHub — convert attacker-influenced agent inputs into host-side code execution and arbitrary file write. CVE-2026-26030 is a Python sandbox escape in the InMemoryVectorStore filter parser (Python SDK < 1.39.4, CWE-94). CVE-2026-25592 is a path-traversal arbitrary file write in the .NET SDK's SessionsPythonPlugin (Microsoft.SemanticKernel.Plugins.Core < 1.71.0; Python < 1.39.3 also affected; CWE-22). Together they expose every Semantic Kernel agent that takes untrusted prompt text or RAG content to direct host compromise.

How Microsoft Semantic Kernel works

Microsoft Semantic Kernel is the company's flagship open-source SDK for building, orchestrating, and deploying single- and multi-agent AI systems across Python and .NET runtimes. In February 2026, Microsoft's AI Red Team (Amit Eliahu, Doreen Dryasher, Uri Oren) disclosed two coordinated GitHub Security Advisories — GHSA-xjw9-4gw8-4rqx and GHSA-2ww3-72rp-wpp4 — describing a paired RCE / arbitrary-file-write chain that affects the SDK's two most agent-facing surfaces.

CVE-2026-26030 (CVSS 9.9, CWE-94) lives in `semantic_kernel.connectors.in_memory.InMemoryCollection._parse_and_validate_filter`. The filter API accepts a string lambda (e.g., `lambda r: r.field == 'value'`), parses it with Python's `ast` module, and then `eval`s the compiled callable. The pre-1.39.4 AST validator only walked node types and `Name` identifiers — it never inspected `Attribute` nodes. An attacker who controls any portion of a filter string (typically via prompt injection that causes a tool-using agent to construct a filter from RAG output, user message content, or document metadata) can chain Python's classic `__class__.__bases__[0].__subclasses__()` introspection escape to reach `os.system`, `subprocess.Popen`, or `builtins.__import__('os').system(...)` and obtain arbitrary code execution in the host process running the agent. The patch (PR #13505) introduces a 35-name blocklist of dangerous dunder attributes (`__class__`, `__bases__`, `__mro__`, `__subclasses__`, `__globals__`, `__builtins__`, `__import__`, `__getattribute__`, `gi_frame`, `f_globals`, `co_consts`, etc.) and rejects any AST `Attribute` node that targets one of them.

CVE-2026-25592 (CVSS 9.9, CWE-22) lives in `Microsoft.SemanticKernel.Plugins.Core.SessionsPythonPlugin` — the .NET integration that lets a kernel call into Azure Container Apps / Dynamic Sessions for sandboxed Python execution. The plugin's `UploadFileAsync` and `DownloadFileAsync` methods are decorated `[KernelFunction]` with `[Description]` attributes that expose `localFilePath` to function-calling LLMs as a freely chosen argument. Pre-1.71.0 the SDK passed that string straight to `File.ReadAllBytes(localFilePath)` and `File.WriteAllBytesAsync(localFilePath, ...)` with no validation. A prompt-injected agent could therefore write attacker-controlled bytes (downloaded from the sandboxed session, but seeded from the same prompt) to any path the host process can reach — `..\..\Windows\System32\config\...`, `/etc/cron.d/`, scheduled task XMLs, startup folders, SSH `authorized_keys`, IIS web roots, or simply overwriting the agent host binary itself for next-restart code execution. The patch (PR #13478) gates both methods behind `SessionsPythonSettings.EnableDangerousFileUploads` (default false) and `AllowedUploadDirectories` / `AllowedDownloadDirectories` allowlists, plus removes the `[Description]` from `DownloadFileAsync` so the LLM can no longer auto-select the function. The Python SDK version of the same plugin was patched separately in 1.39.3.

These are the first publicly disclosed network-exploitable, scope-changed (Sandbox -> Host) CVSS 9.9 RCEs against an enterprise AI agent SDK. The exploitability story is non-traditional: there is no remote network listener to scan and exploit. Instead, the attack surface is every place where an Agent receives untrusted text — RAG document chunks, web pages it browses, email it summarises, ticket bodies it triages, or even the tool outputs of other agents in a multi-agent system. Microsoft's own samples (CodeInterpreterPlugin demo, Vector Store quickstarts) ship configurations vulnerable by default. Both CVEs are patched but require operator action: SDK upgrade, settings change for SessionsPythonPlugin, and (recommended) elimination of `InMemoryVectorStore` from production. As of disclosure no in-the-wild exploitation chain has been published, but Microsoft's advisory text rates exploitability `POC_PUBLIC` because the patches themselves disclose the vulnerable code paths.

MITRE ATT&CK techniques used in TL-2026-0481

Collection

T1005 Data from Local System

Defense Evasion

T1027 Obfuscated Files or Information; T1070.004 Indicator Removal: File Deletion

Exfiltration

T1041 Exfiltration Over C2 Channel

Persistence

T1053.003 Scheduled Task/Job: Cron; T1053.005 Scheduled Task/Job: Scheduled Task; T1505.003 Server Software Component: Web Shell; T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

Discovery

T1057 Process Discovery; T1083 File and Directory Discovery

Execution

T1059.001 Command and Scripting Interpreter: PowerShell; T1059.006 Command and Scripting Interpreter: Python; T1106 Native API; T1204.002 User Execution: Malicious File

Command and Control

T1071.001 Application Layer Protocol: Web Protocols; T1105 Ingress Tool Transfer

Initial Access

T1190 Exploit Public-Facing Application; T1199 Trusted Relationship

Credential Access

T1528 Steal Application Access Token; T1552.001 Unsecured Credentials: Credentials In Files

Lateral Movement

T1534 Internal Spearphishing

defense-impairment

T1553.002 Subvert Trust Controls: Code Signing

Impact

T1565.001 Data Manipulation: Stored Data Manipulation

stealth

T1574.001 DLL; T1574.007 Hijack Execution Flow: Path Interception by PATH Environment Variable

Affected products and versions in Microsoft Semantic Kernel

  • Microsoft — Semantic Kernel Python SDK
    Vulnerable versions: < 1.39.4
    Fixed in: 1.39.4; 1.39.5+
  • Microsoft — Semantic Kernel .NET SDK — Plugins.Core
    Vulnerable versions: < 1.71.0
    Fixed in: 1.71.0; 1.72.0+
  • Microsoft — Semantic Kernel Python SDK — SessionsPythonPlugin (also affected by CVE-2026-25592)
    Vulnerable versions: < 1.39.3
    Fixed in: 1.39.3; 1.39.4+
  • Microsoft — Semantic Kernel .NET SDK — Core
    Vulnerable versions: < 1.71.0
    Fixed in: 1.71.0+

Remediation for Microsoft Semantic Kernel

Patches

  • Python: pip install --upgrade semantic-kernel>=1.39.4
  • .NET: dotnet add package Microsoft.SemanticKernel.Plugins.Core --version 1.71.0
  • .NET: dotnet add package Microsoft.SemanticKernel.Core --version 1.71.0
  • Apply microsoft/semantic-kernel PR #13505 (Python AST attribute blocklist)
  • Apply microsoft/semantic-kernel PR #13478 (.NET SessionsPythonPlugin allowlist)

Immediate actions

  • Inventory every Semantic Kernel deployment: `pip show semantic-kernel`; `dotnet list package | grep -i SemanticKernel`.
  • Upgrade Python SDK to >= 1.39.4 (covers both CVE-2026-26030 and CVE-2026-25592 Python branch).
  • Upgrade Microsoft.SemanticKernel.Plugins.Core (and Microsoft.SemanticKernel.Core) to >= 1.71.0.
  • Audit any code that calls InMemoryCollection.get / search with a string-lambda `filter` argument — replace user-influenced filter strings with parameterized field/value pairs.
  • Set `SessionsPythonSettings.EnableDangerousFileUploads = false` in every SessionsPythonPlugin instance until allowlist is configured.
  • Add a Function Invocation Filter that rejects calls to UploadFileAsync / DownloadFileAsync whose `localFilePath` is absolute or contains `..` segments.

Workarounds

  • Avoid InMemoryVectorStore entirely in production deployments (Microsoft official guidance).
  • Wrap any filter expression in a server-side allowlist of known-safe field names before passing to InMemoryCollection.
  • Disable SessionsPythonPlugin file-upload/download methods via plugin filtering until upgrade.
  • Run all Semantic Kernel hosts as low-privilege users with no write access to system directories or cron/Task Scheduler paths.

Longer-term hardening

  • Treat every prompt-influenced string as untrusted input across all SDKs — apply the same review burden as SQL parameters.
  • Adopt Microsoft Prompt Shields (or equivalent) on agent inputs to detect indirect prompt injection from RAG / web / email content.
  • Move InMemoryVectorStore deployments to a managed vector store (Azure AI Search, Qdrant, Weaviate, pgvector) — Microsoft now explicitly states InMemoryVectorStore is not for production.
  • Sandbox all Semantic Kernel agent processes (containers with read-only root FS, no network egress except declared LLM endpoints).
  • Expand SBOM scanning to flag pip semantic-kernel < 1.39.4 and NuGet Microsoft.SemanticKernel.* < 1.71.0 as criticals.
  • Implement per-agent function allowlists — disable any [KernelFunction] that exposes filesystem or process control to model-generated arguments.

CVEs associated with Microsoft Semantic Kernel

CVE-2026-26030, CVE-2026-25592

Weaknesses (CWE) in Microsoft Semantic Kernel

CWE-94, CWE-22, CWE-693, CWE-915

Timeline of Microsoft Semantic Kernel

  • Microsoft AI Red Team (Amit Eliahu, Doreen Dryasher, Uri Oren) identifies the InMemoryVectorStore filter sandbox escape and SessionsPythonPlugin path-traversal during proactive review of agentic SDK attack surfaces.
  • Microsoft Security Response Center triages both findings as CRITICAL and assigns CVE identifiers CVE-2026-25592 and CVE-2026-26030; engineering work begins on coordinated patches.
  • NVD publishes CVE-2026-25592 with CVSS 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), CWE-22 path traversal.
  • GHSA-2ww3-72rp-wpp4 published; Microsoft.SemanticKernel.Plugins.Core 1.71.0 released alongside PR #13478 introducing EnableDangerousFileUploads gate and AllowedUpload/DownloadDirectories allowlists; Python SDK 1.39.3 ships the same plugin fix.
  • NVD publishes CVE-2026-26030 with CVSS 9.9, CWE-94 code injection; Microsoft advisory text recommends abandoning InMemoryVectorStore for production.
  • GHSA-xjw9-4gw8-4rqx published; Semantic Kernel python-1.39.4 release ships PR #13505 introducing 35-name dunder attribute blocklist in AST filter validator.
  • NVD analysis status moves to 'Analyzed' for CVE-2026-26030; CPE matching confirms scope is all pip semantic-kernel below 1.39.4.
  • Independent security researchers publish technical analyses demonstrating Python sandbox escape via __class__.__bases__[0].__subclasses__() chain in InMemoryCollection filter strings; community PoCs circulate on GitHub.
  • NVD moves CVE-2026-25592 to 'Deferred' status as patches gain wide adoption; CISA continues monitoring for ITW exploitation.
  • Threadlinqs Intelligence publishes consolidated TL-2026-0481 advisory bundling both CVEs with full MITRE mapping, IOCs, simulations, and detection coverage.
  • As of 2026-05-29, both Semantic Kernel CVEs (CVE-2026-26030, CVE-2026-25592) are patched (Python 1.39.4, .NET 1.71.0, out ~3-4 months) with no confirmed in-the-wild exploitation and no CISA KEV listing. They stay a live concern: public PoCs exist, Microsoft re-published research on 2026-05-07, and unpatched SDK installs remain exploitable via prompt injection.

Sources cited for Microsoft Semantic Kernel

Threats related to Microsoft Semantic Kernel

Detection coverage for TL-2026-0481

As of 2026-05-08, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0481 across Splunk SPL, Microsoft KQL and Sigma, covering 26 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Further reading

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats