Microsoft Semantic Kernel — Critical RCE & Arbitrary File Write Chain (CVE-2026-26030, CVE-2026-25592) — Threadlinqs Intelligence
As of 2026-05-30, Microsoft Semantic Kernel — Critical RCE & Arbitrary File Write Chain (CVE-2026-26030, CVE-2026-25592) is a critical-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 26 indicators of compromise.
Threat ID: TL-2026-0481 · Severity: CRITICAL · CVSS: 9.9 · Status: MONITORING · Category: VULNERABILITY
Two vendor-confirmed CRITICAL vulnerabilities (both CVSS 9.9, scope-changed) in Microsoft's Semantic Kernel — the AI agent orchestration SDK with 27.9k stars on GitHub — convert attacker-influenced
Microsoft Semantic Kernel is the company's flagship open-source SDK for building, orchestrating, and deploying single- and multi-agent AI systems across Python and .NET runtimes. In February 2026, Microsoft's AI Red Team (Amit Eliahu, Doreen Dryasher, Uri Oren) disclosed two coordinated GitHub Security Advisories — GHSA-xjw9-4gw8-4rqx and GHSA-2ww3-72rp-wpp4 — describing a paired RCE / arbitrary-file-write chain that affects the SDK's two most agent-facing surfaces.
CVE-2026-26030 (CVSS 9.9, CWE-94) lives in `semantic_kernel.connectors.in_memory.InMemoryCollection._parse_and_validate_filter`. The filter API accepts a string lambda (e.g., `lambda r: r.field == 'value'`), parses it with Python's `ast` module, and then `eval`s the compiled callable. The pre-1.39.4 AST validator only walked node types and `Name` identifiers — it never inspected `Attribute` nodes. An attacker who controls any portion of a filter string (typically via prompt injection that causes a tool-using agent to construct a filter from RAG output, user message content, or document metadata) can chain Python's classic `__class__.__bases__[0].__subclasses__()` introspection escape to reach `os.system`, `subprocess.Popen`, or `builtins.__import__('os').system(...)` and obtain arbitrary code execution in the host process running the agent. The patch (PR #13505) introduces a 35-name blocklist of dangerous dunder attributes (`__class__`, `__bases__`, `__mro__`, `__subclasses__`, `__globals__`, `__builtins__`, `__import__`, `__getattribute__`, `gi_frame`, `f_globals`, `co_consts`, etc.) and rejects any AST `Attribute` node that targets one of them.
CVE-2026-25592 (CVSS 9.9, CWE-22) lives in `Microsoft.SemanticKernel.Plugins.Core.SessionsPythonPlugin` — the .NET integration that lets a kernel call into Azure Container Apps / Dynamic Sessions for sandboxed Python execution. The plugin's `UploadFileAsync` and `DownloadFileAsync` methods are decorated `[KernelFunction]` with `[Description]` attributes that expose `localFilePath` to function-calling LLMs as a freely chosen argument. Pre-1.71.0 the SDK passed that string straight to `File.ReadAllBytes(localFilePath)` and `File.WriteAllBytesAsync(localFilePath, ...)` with no validation. A prompt-injected agent could therefore write attacker-controlled bytes (downloaded from the sandboxed session, but seeded from the same prompt) to any path the host process can reach — `..\..\Windows\System32\config\...`, `/etc/cron.d/`, scheduled task XMLs, startup folders, SSH `authorized_keys`, IIS web roots, or simply overwriting the agent host binary itself for next-restart code execution. The patch (PR #13478) gates both methods behind `SessionsPythonSettings.EnableDangerousFileUploads` (default false) and `AllowedUploadDirectories` / `AllowedDownloadDirectories` allowlists, plus removes the `[Description]` from `DownloadFileAsync` so the LLM can no longer auto-select the function. The Python SDK version of the same plugin was patched separately in 1.39.3.
These are the first publicly disclosed network-exploitable, scope-changed (Sandbox -> Host) CVSS 9.9 RCEs against an enterprise AI agent SDK. The exploitability story is non-traditional: there is no remote network listener to scan and exploit. Instead, the attack surface is every place where an Agent receives untrusted text — RAG document chunks, web pages it browses, email it summarises, ticket bodies it triages, or even the tool outputs of other agents in a multi-agent system. Microsoft's own samples (CodeInterpreterPlugin demo, Vector Store quickstarts) ship configurations vulnerable by default. Both CVEs are patched but require operator action: SDK upgrade, settings change for SessionsPythonPlugin, and (recommended) elimination of `InMemoryVectorStore` from production. As of disclosure no in-the-wild exploitation chain has been published, but Microsoft's advisory text rates exploitability `POC_PUBLIC` because the patches themselves disclose the vulnerable code paths.
Weaknesses (CWE)
CWE-94, CWE-22, CWE-693, CWE-915
Target sectors: technology, financial, healthcare, government, retail, manufacturing, professional-services, saas, ai-platform-providers
Target regions: Global, North America, Europe, Asia-Pacific
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 26 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, CRITICAL, threat intelligence, cybersecurity, CVE-2026-26030, CVE-2026-25592, T1190, T1199, T1059.006, T1059.001, T1106, T1204.002, T1547.001, T1053.003, T1053.005, T1505.003