Threat reportVulnerabilityTL-2026-0481
Microsoft Semantic Kernel — Critical RCE & Arbitrary File Write Chain (CVE-2026-26030, CVE-2026-25592)
Microsoft Semantic Kernel (TL-2026-0481), also tracked as Semantic Kernel RCE Chain, is a critical-severity software vulnerability scored CVSS 9.9, first published 2026-05-08. It has no confirmed attribution, affects Microsoft Semantic Kernel Python SDK, references 2 CVEs (CVE-2026-26030, CVE-2026-25592), maps to 25 MITRE ATT&CK techniques (T1005, T1027, T1041), and is covered by 9 detection rules and 26 indicators of compromise.
- CVSS
- 9.9/10Critical
- CVEs
- 2Referenced vulnerabilities
- Techniques
- 25MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 26Indicators of compromise
Key facts for TL-2026-0481
- Threat ID
- TL-2026-0481
- Also known as
- Semantic Kernel RCE Chain, GHSA-xjw9-4gw8-4rqx, GHSA-2ww3-72rp-wpp4
- Severity
- CRITICAL
- CVSS
- 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
- Status
- MONITORING
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- NONE
- Motivation
- UNKNOWN
- Target sectors
- technology, financial, healthcare, government, retail, manufacturing, professional-services, saas, ai-platform-providers
- Target regions
- Global, North America, Europe, Asia-Pacific
- Detection rules
- 9
- Indicators of compromise
- 26
Malware and tooling in Microsoft Semantic Kernel
Malware and tooling: Microsoft Semantic Kernel SDK
How Microsoft Semantic Kernel works
Two vendor-confirmed CRITICAL vulnerabilities (both CVSS 9.9, scope-changed) in Microsoft's Semantic Kernel — the AI agent orchestration SDK with 27.9k stars on GitHub — convert attacker-influenced agent inputs into host-side code execution and arbitrary file write. CVE-2026-26030 is a Python sandbox escape in the InMemoryVectorStore filter parser (Python SDK < 1.39.4, CWE-94). CVE-2026-25592 is a path-traversal arbitrary file write in the .NET SDK's SessionsPythonPlugin (Microsoft.SemanticKernel.Plugins.Core < 1.71.0; Python < 1.39.3 also affected; CWE-22). Together they expose every Semantic Kernel agent that takes untrusted prompt text or RAG content to direct host compromise.
Microsoft Semantic Kernel is the company's flagship open-source SDK for building, orchestrating, and deploying single- and multi-agent AI systems across Python and .NET runtimes. In February 2026, Microsoft's AI Red Team (Amit Eliahu, Doreen Dryasher, Uri Oren) disclosed two coordinated GitHub Security Advisories — GHSA-xjw9-4gw8-4rqx and GHSA-2ww3-72rp-wpp4 — describing a paired RCE / arbitrary-file-write chain that affects the SDK's two most agent-facing surfaces.
CVE-2026-26030 (CVSS 9.9, CWE-94) lives in `semantic_kernel.connectors.in_memory.InMemoryCollection._parse_and_validate_filter`. The filter API accepts a string lambda (e.g., `lambda r: r.field == 'value'`), parses it with Python's `ast` module, and then `eval`s the compiled callable. The pre-1.39.4 AST validator only walked node types and `Name` identifiers — it never inspected `Attribute` nodes. An attacker who controls any portion of a filter string (typically via prompt injection that causes a tool-using agent to construct a filter from RAG output, user message content, or document metadata) can chain Python's classic `__class__.__bases__[0].__subclasses__()` introspection escape to reach `os.system`, `subprocess.Popen`, or `builtins.__import__('os').system(...)` and obtain arbitrary code execution in the host process running the agent. The patch (PR #13505) introduces a 35-name blocklist of dangerous dunder attributes (`__class__`, `__bases__`, `__mro__`, `__subclasses__`, `__globals__`, `__builtins__`, `__import__`, `__getattribute__`, `gi_frame`, `f_globals`, `co_consts`, etc.) and rejects any AST `Attribute` node that targets one of them.
CVE-2026-25592 (CVSS 9.9, CWE-22) lives in `Microsoft.SemanticKernel.Plugins.Core.SessionsPythonPlugin` — the .NET integration that lets a kernel call into Azure Container Apps / Dynamic Sessions for sandboxed Python execution. The plugin's `UploadFileAsync` and `DownloadFileAsync` methods are decorated `[KernelFunction]` with `[Description]` attributes that expose `localFilePath` to function-calling LLMs as a freely chosen argument. Pre-1.71.0 the SDK passed that string straight to `File.ReadAllBytes(localFilePath)` and `File.WriteAllBytesAsync(localFilePath, ...)` with no validation. A prompt-injected agent could therefore write attacker-controlled bytes (downloaded from the sandboxed session, but seeded from the same prompt) to any path the host process can reach — `..\..\Windows\System32\config\...`, `/etc/cron.d/`, scheduled task XMLs, startup folders, SSH `authorized_keys`, IIS web roots, or simply overwriting the agent host binary itself for next-restart code execution. The patch (PR #13478) gates both methods behind `SessionsPythonSettings.EnableDangerousFileUploads` (default false) and `AllowedUploadDirectories` / `AllowedDownloadDirectories` allowlists, plus removes the `[Description]` from `DownloadFileAsync` so the LLM can no longer auto-select the function. The Python SDK version of the same plugin was patched separately in 1.39.3.
These are the first publicly disclosed network-exploitable, scope-changed (Sandbox -> Host) CVSS 9.9 RCEs against an enterprise AI agent SDK. The exploitability story is non-traditional: there is no remote network listener to scan and exploit. Instead, the attack surface is every place where an Agent receives untrusted text — RAG document chunks, web pages it browses, email it summarises, ticket bodies it triages, or even the tool outputs of other agents in a multi-agent system. Microsoft's own samples (CodeInterpreterPlugin demo, Vector Store quickstarts) ship configurations vulnerable by default. Both CVEs are patched but require operator action: SDK upgrade, settings change for SessionsPythonPlugin, and (recommended) elimination of `InMemoryVectorStore` from production. As of disclosure no in-the-wild exploitation chain has been published, but Microsoft's advisory text rates exploitability `POC_PUBLIC` because the patches themselves disclose the vulnerable code paths.
MITRE ATT&CK techniques used in TL-2026-0481
Collection
Defense Evasion
T1027 Obfuscated Files or Information; T1070.004 Indicator Removal: File Deletion
Exfiltration
T1041 Exfiltration Over C2 Channel
Persistence
T1053.003 Scheduled Task/Job: Cron; T1053.005 Scheduled Task/Job: Scheduled Task; T1505.003 Server Software Component: Web Shell; T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Discovery
T1057 Process Discovery; T1083 File and Directory Discovery
Execution
T1059.001 Command and Scripting Interpreter: PowerShell; T1059.006 Command and Scripting Interpreter: Python; T1106 Native API; T1204.002 User Execution: Malicious File
Command and Control
T1071.001 Application Layer Protocol: Web Protocols; T1105 Ingress Tool Transfer
Initial Access
T1190 Exploit Public-Facing Application; T1199 Trusted Relationship
Credential Access
T1528 Steal Application Access Token; T1552.001 Unsecured Credentials: Credentials In Files
Lateral Movement
defense-impairment
T1553.002 Subvert Trust Controls: Code Signing
Impact
T1565.001 Data Manipulation: Stored Data Manipulation
stealth
T1574.001 DLL; T1574.007 Hijack Execution Flow: Path Interception by PATH Environment Variable
Affected products and versions in Microsoft Semantic Kernel
- Microsoft — Semantic Kernel Python SDK
Vulnerable versions: < 1.39.4
Fixed in: 1.39.4; 1.39.5+ - Microsoft — Semantic Kernel .NET SDK — Plugins.Core
Vulnerable versions: < 1.71.0
Fixed in: 1.71.0; 1.72.0+ - Microsoft — Semantic Kernel Python SDK — SessionsPythonPlugin (also affected by CVE-2026-25592)
Vulnerable versions: < 1.39.3
Fixed in: 1.39.3; 1.39.4+ - Microsoft — Semantic Kernel .NET SDK — Core
Vulnerable versions: < 1.71.0
Fixed in: 1.71.0+
Remediation for Microsoft Semantic Kernel
Patches
- Python: pip install --upgrade semantic-kernel>=1.39.4
- .NET: dotnet add package Microsoft.SemanticKernel.Plugins.Core --version 1.71.0
- .NET: dotnet add package Microsoft.SemanticKernel.Core --version 1.71.0
- Apply microsoft/semantic-kernel PR #13505 (Python AST attribute blocklist)
- Apply microsoft/semantic-kernel PR #13478 (.NET SessionsPythonPlugin allowlist)
Immediate actions
- Inventory every Semantic Kernel deployment: `pip show semantic-kernel`; `dotnet list package | grep -i SemanticKernel`.
- Upgrade Python SDK to >= 1.39.4 (covers both CVE-2026-26030 and CVE-2026-25592 Python branch).
- Upgrade Microsoft.SemanticKernel.Plugins.Core (and Microsoft.SemanticKernel.Core) to >= 1.71.0.
- Audit any code that calls InMemoryCollection.get / search with a string-lambda `filter` argument — replace user-influenced filter strings with parameterized field/value pairs.
- Set `SessionsPythonSettings.EnableDangerousFileUploads = false` in every SessionsPythonPlugin instance until allowlist is configured.
- Add a Function Invocation Filter that rejects calls to UploadFileAsync / DownloadFileAsync whose `localFilePath` is absolute or contains `..` segments.
Workarounds
- Avoid InMemoryVectorStore entirely in production deployments (Microsoft official guidance).
- Wrap any filter expression in a server-side allowlist of known-safe field names before passing to InMemoryCollection.
- Disable SessionsPythonPlugin file-upload/download methods via plugin filtering until upgrade.
- Run all Semantic Kernel hosts as low-privilege users with no write access to system directories or cron/Task Scheduler paths.
Longer-term hardening
- Treat every prompt-influenced string as untrusted input across all SDKs — apply the same review burden as SQL parameters.
- Adopt Microsoft Prompt Shields (or equivalent) on agent inputs to detect indirect prompt injection from RAG / web / email content.
- Move InMemoryVectorStore deployments to a managed vector store (Azure AI Search, Qdrant, Weaviate, pgvector) — Microsoft now explicitly states InMemoryVectorStore is not for production.
- Sandbox all Semantic Kernel agent processes (containers with read-only root FS, no network egress except declared LLM endpoints).
- Expand SBOM scanning to flag pip semantic-kernel < 1.39.4 and NuGet Microsoft.SemanticKernel.* < 1.71.0 as criticals.
- Implement per-agent function allowlists — disable any [KernelFunction] that exposes filesystem or process control to model-generated arguments.
CVEs associated with Microsoft Semantic Kernel
Weaknesses (CWE) in Microsoft Semantic Kernel
Timeline of Microsoft Semantic Kernel
- Microsoft AI Red Team (Amit Eliahu, Doreen Dryasher, Uri Oren) identifies the InMemoryVectorStore filter sandbox escape and SessionsPythonPlugin path-traversal during proactive review of agentic SDK attack surfaces.
- Microsoft Security Response Center triages both findings as CRITICAL and assigns CVE identifiers CVE-2026-25592 and CVE-2026-26030; engineering work begins on coordinated patches.
- NVD publishes CVE-2026-25592 with CVSS 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), CWE-22 path traversal.
- GHSA-2ww3-72rp-wpp4 published; Microsoft.SemanticKernel.Plugins.Core 1.71.0 released alongside PR #13478 introducing EnableDangerousFileUploads gate and AllowedUpload/DownloadDirectories allowlists; Python SDK 1.39.3 ships the same plugin fix.
- NVD publishes CVE-2026-26030 with CVSS 9.9, CWE-94 code injection; Microsoft advisory text recommends abandoning InMemoryVectorStore for production.
- GHSA-xjw9-4gw8-4rqx published; Semantic Kernel python-1.39.4 release ships PR #13505 introducing 35-name dunder attribute blocklist in AST filter validator.
- NVD analysis status moves to 'Analyzed' for CVE-2026-26030; CPE matching confirms scope is all pip semantic-kernel below 1.39.4.
- Independent security researchers publish technical analyses demonstrating Python sandbox escape via __class__.__bases__[0].__subclasses__() chain in InMemoryCollection filter strings; community PoCs circulate on GitHub.
- NVD moves CVE-2026-25592 to 'Deferred' status as patches gain wide adoption; CISA continues monitoring for ITW exploitation.
- Threadlinqs Intelligence publishes consolidated TL-2026-0481 advisory bundling both CVEs with full MITRE mapping, IOCs, simulations, and detection coverage.
- As of 2026-05-29, both Semantic Kernel CVEs (CVE-2026-26030, CVE-2026-25592) are patched (Python 1.39.4, .NET 1.71.0, out ~3-4 months) with no confirmed in-the-wild exploitation and no CISA KEV listing. They stay a live concern: public PoCs exist, Microsoft re-published research on 2026-05-07, and unpatched SDK installs remain exploitable via prompt injection.
Sources cited for Microsoft Semantic Kernel
- NVD — CVE-2026-26030 (Semantic Kernel Python InMemoryVectorStore RCE)
- NVD — CVE-2026-25592 (Semantic Kernel .NET SessionsPythonPlugin Arbitrary File Write)
- GHSA-xjw9-4gw8-4rqx — InMemoryVectorStore filter functionality vulnerable to remote code execution
- GHSA-2ww3-72rp-wpp4 — Arbitrary File Write via AI Agent Function Calling in .NET SDK
- Patch PR #13505 — block dangerous attribute names in filter expressions
- Release python-1.39.4
- Patch PR #13478 — Add file upload security controls to SessionsPythonPlugin
- Microsoft Semantic Kernel project — README
- OWASP LLM Top 10 — LLM01:2025 Prompt Injection
- MITRE ATT&CK — T1059.006 Command and Scripting Interpreter: Python
- Microsoft AI Red Team — Public research portal
Detection coverage for TL-2026-0481
As of 2026-05-08, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0481 across Splunk SPL, Microsoft KQL and Sigma, covering 26 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.