# Microsoft Semantic Kernel — Critical RCE & Arbitrary File Write Chain (CVE-2026-26030, CVE-2026-25592)

> Two vendor-confirmed CRITICAL vulnerabilities (both CVSS 9.9, scope-changed) in Microsoft's Semantic Kernel — the AI agent orchestration SDK with 27.9k stars on GitHub — convert attacker-influenced agent inputs into host-side code execution and arbitrary file write. CVE-2026-26030 is a Python sandbox escape in the InMemoryVectorStore filter parser (Python SDK < 1.39.4, CWE-94). CVE-2026-25592 is a path-traversal arbitrary file write in the .NET SDK's SessionsPythonPlugin (Microsoft.SemanticKernel.Plugins.Core < 1.71.0; Python < 1.39.3 also affected; CWE-22). Together they expose every Semantic Kernel agent that takes untrusted prompt text or RAG content to direct host compromise.

- **Published:** 2026-05-08T12:00:00Z
- **Last reviewed:** 2026-05-08T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0481
- **ID:** TL-2026-0481
- **Severity:** CRITICAL (CVSS 9.9)
- **Category:** VULNERABILITY
- **Status:** MONITORING
- **Detections:** 9 · **IOCs:** 26 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-26030, CVE-2026-25592

## Description

Microsoft Semantic Kernel is the company's flagship open-source SDK for building, orchestrating, and deploying single- and multi-agent AI systems across Python and .NET runtimes. In February 2026, Microsoft's AI Red Team (Amit Eliahu, Doreen Dryasher, Uri Oren) disclosed two coordinated GitHub Security Advisories — GHSA-xjw9-4gw8-4rqx and GHSA-2ww3-72rp-wpp4 — describing a paired RCE / arbitrary-file-write chain that affects the SDK's two most agent-facing surfaces.

CVE-2026-26030 (CVSS 9.9, CWE-94) lives in `semantic_kernel.connectors.in_memory.InMemoryCollection._parse_and_validate_filter`. The filter API accepts a string lambda (e.g., `lambda r: r.field == 'value'`), parses it with Python's `ast` module, and then `eval`s the compiled callable. The pre-1.39.4 AST validator only walked node types and `Name` identifiers — it never inspected `Attribute` nodes. An attacker who controls any portion of a filter string (typically via prompt injection that causes a tool-using agent to construct a filter from RAG output, user message content, or document metadata) can chain Python's classic `__class__.__bases__[0].__subclasses__()` introspection escape to reach `os.system`, `subprocess.Popen`, or `builtins.__import__('os').system(...)` and obtain arbitrary code execution in the host process running the agent. The patch (PR #13505) introduces a 35-name blocklist of dangerous dunder attributes (`__class__`, `__bases__`, `__mro__`, `__subclasses__`, `__globals__`, `__builtins__`, `__import__`, `__getattribute__`, `gi_frame`, `f_globals`, `co_consts`, etc.) and rejects any AST `Attribute` node that targets one of them.

CVE-2026-25592 (CVSS 9.9, CWE-22) lives in `Microsoft.SemanticKernel.Plugins.Core.SessionsPythonPlugin` — the .NET integration that lets a kernel call into Azure Container Apps / Dynamic Sessions for sandboxed Python execution. The plugin's `UploadFileAsync` and `DownloadFileAsync` methods are decorated `[KernelFunction]` with `[Description]` attributes that expose `localFilePath` to function-calling LLMs as a freely chosen argument. Pre-1.71.0 the SDK passed that string straight to `File.ReadAllBytes(localFilePath)` and `File.WriteAllBytesAsync(localFilePath, ...)` with no validation. A prompt-injected agent could therefore write attacker-controlled bytes (downloaded from the sandboxed session, but seeded from the same prompt) to any path the host process can reach — `..\..\Windows\System32\config\...`, `/etc/cron.d/`, scheduled task XMLs, startup folders, SSH `authorized_keys`, IIS web roots, or simply overwriting the agent host binary itself for next-restart code execution. The patch (PR #13478) gates both methods behind `SessionsPythonSettings.EnableDangerousFileUploads` (default false) and `AllowedUploadDirectories` / `AllowedDownloadDirectories` allowlists, plus removes the `[Description]` from `DownloadFileAsync` so the LLM can no longer auto-select the function. The Python SDK version of the same plugin was patched separately in 1.39.3.

These are the first publicly disclosed network-exploitable, scope-changed (Sandbox -> Host) CVSS 9.9 RCEs against an enterprise AI agent SDK. The exploitability story is non-traditional: there is no remote network listener to scan and exploit. Instead, the attack surface is every place where an Agent receives untrusted text — RAG document chunks, web pages it browses, email it summarises, ticket bodies it triages, or even the tool outputs of other agents in a multi-agent system. Microsoft's own samples (CodeInterpreterPlugin demo, Vector Store quickstarts) ship configurations vulnerable by default. Both CVEs are patched but require operator action: SDK upgrade, settings change for SessionsPythonPlugin, and (recommended) elimination of `InMemoryVectorStore` from production. As of disclosure no in-the-wild exploitation chain has been published, but Microsoft's advisory text rates exploitability `POC_PUBLIC` because the patches themselves disclose the vulnerable code paths.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1199 Trusted Relationship
- T1059.006 Command and Scripting Interpreter: Python
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1106 Native API
- T1204.002 User Execution: Malicious File
- T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
- T1053.003 Scheduled Task/Job: Cron
- T1053.005 Scheduled Task/Job: Scheduled Task
- T1505.003 Server Software Component: Web Shell
- T1574.007 Hijack Execution Flow: Path Interception by PATH Environment Variable
- T1574.001 DLL
- T1027 Obfuscated Files or Information
- T1070.004 Indicator Removal: File Deletion
- T1553.002 Subvert Trust Controls: Code Signing
- T1552.001 Unsecured Credentials: Credentials In Files
- T1528 Steal Application Access Token
- T1083 File and Directory Discovery
- T1057 Process Discovery
- T1534 Internal Spearphishing
- T1005 Data from Local System
- T1071.001 Application Layer Protocol: Web Protocols
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel
- T1565.001 Data Manipulation: Stored Data Manipulation

## Sources

- [NVD — CVE-2026-26030 (Semantic Kernel Python InMemoryVectorStore RCE)](https://nvd.nist.gov/vuln/detail/CVE-2026-26030)
- [NVD — CVE-2026-25592 (Semantic Kernel .NET SessionsPythonPlugin Arbitrary File Write)](https://nvd.nist.gov/vuln/detail/CVE-2026-25592)
- [GHSA-xjw9-4gw8-4rqx — InMemoryVectorStore filter functionality vulnerable to remote code execution](https://github.com/microsoft/semantic-kernel/security/advisories/GHSA-xjw9-4gw8-4rqx)
- [GHSA-2ww3-72rp-wpp4 — Arbitrary File Write via AI Agent Function Calling in .NET SDK](https://github.com/microsoft/semantic-kernel/security/advisories/GHSA-2ww3-72rp-wpp4)
- [Patch PR #13505 — block dangerous attribute names in filter expressions](https://github.com/microsoft/semantic-kernel/pull/13505)
- [Release python-1.39.4](https://github.com/microsoft/semantic-kernel/releases/tag/python-1.39.4)
- [Patch PR #13478 — Add file upload security controls to SessionsPythonPlugin](https://github.com/microsoft/semantic-kernel/pull/13478)
- [Microsoft Semantic Kernel project — README](https://github.com/microsoft/semantic-kernel)
- [OWASP LLM Top 10 — LLM01:2025 Prompt Injection](https://owasp.org/www-project-top-10-for-large-language-model-applications/)
- [MITRE ATT&CK — T1059.006 Command and Scripting Interpreter: Python](https://attack.mitre.org/techniques/T1059/006/)
- [Microsoft AI Red Team — Public research portal](https://www.microsoft.com/security/blog/topic/ai-red-team/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0481