Microsoft Semantic Kernel Prompt-Injection-to-RCE & Arbitrary File Write — CVE-2026-26030 (InMemoryVectorStore eval) + CVE-2026-25592 (SessionsPythonPlugin) — Threadlinqs Intelligence
As of 2026-05-30, Microsoft Semantic Kernel Prompt-Injection-to-RCE & Arbitrary File Write — CVE-2026-26030 (InMemoryVectorStore eval) + CVE-2026-25592 (SessionsPythonPlugin) is a critical-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 22 indicators of compromise.
Threat ID: TL-2026-0489 · Severity: CRITICAL · CVSS: 9.9 · Status: MONITORING · Category: VULNERABILITY
Microsoft disclosed two critical (CVSS 9.9) vulnerabilities in its Semantic Kernel AI agent framework on 2026-05-07. CVE-2026-26030 turns prompt injection into host-level RCE by abusing a Python
Microsoft Security Research disclosed two CVSS 9.9 critical vulnerabilities in Semantic Kernel — Microsoft's flagship open-source agent orchestration framework with 27,000+ GitHub stars and broad use across Microsoft Copilot Studio, Azure AI Foundry, and third-party enterprise AI agents. The disclosure inaugurates a new Microsoft research series targeting agent-framework security; LangChain and CrewAI are publicly flagged as the next research targets.
=== CVE-2026-26030 — Python SDK InMemoryVectorStore eval() RCE ===
The Python SDK's InMemoryVectorStore class accepts a string-form default filter expression (the ``filter`` argument to ``search()`` and ``vectorized_search()``) and lowers it to a runtime-callable predicate via Python's built-in eval(). Microsoft's intent was to support short, JS-like comparison filters (e.g., ``record.tag == 'public'``) that LLMs could synthesize at runtime. To gate dangerous syntax, the SDK ran the filter string through an AST visitor that blocked Name nodes such as ``__import__``, ``eval``, ``exec``, ``open``, ``compile``, and a curated list of builtin attributes.
The blocklist is bypassable. Because the AST visitor only matches direct Name nodes and a handful of Attribute names, an attacker can reach arbitrary builtins through indirect access patterns that the validator never normalizes:
* ``().__class__.__base__.__subclasses__()[N]`` — classic Python sandbox escape via the object subclass tree, which the validator does not flatten.
* ``getattr(getattr(record, '__class__'), '__init__').__globals__['__builtins__']`` — globals reach via attribute chains.
* ``[c for c in ().__class__.__mro__[-1].__subclasses__() if c.__name__ == 'BuiltinImporter'][0]`` — list comprehensions whose generator expressions execute under eval()'s scope.
* ``type(lambda:0)('x','x',(object,),{}).__init_subclass__.__self__.__subclasses__()`` — type() construction.
With any of these, the attacker pivots to ``os.system`` / ``subprocess.Popen`` / ``importlib.import_module`` and obtains arbitrary command execution under the agent host's identity. The payload runs synchronously inside the agent's Python process, so it inherits whatever credentials, mounted secrets, Azure managed identity, or vector-store data the agent has access to.
Attack vector: the filter string is frequently produced by the LLM itself (for retrieval-augmented generation flows where the model reasons about which documents to retrieve and emits the filter as a tool argument). Any prompt-injection vector — direct user input, document content fed into the agent, web-page content scraped by a tool, email body, calendar event, knowledge-base record — that can influence the model's tool argument synthesis can therefore drive RCE. Microsoft's blog post demonstrates a one-shot PoC where an attacker emails a malicious document to a Copilot-style agent and the agent runs ``calc.exe`` on the host within a single turn.
=== CVE-2026-25592 — .NET SDK SessionsPythonPlugin Arbitrary File Write ===
The .NET SDK ships a SessionsPythonPlugin that lets agents create, list, delete, upload, and download files inside an Azure Container Apps Dynamic Sessions Python sandbox. The ``UploadFileAsync`` method takes a remote file path as a string argument and forwards it to the Sessions REST API without canonicalization. The remote path is interpreted relative to the session's ``/mnt/data`` working directory, but the plugin does not strip ``..`` segments, reject absolute paths, or constrain the destination to ``/mnt/data``.
An attacker that can influence the plugin's ``remote_file_path`` argument (again, typically by prompt injection that controls the LLM's tool-call arguments) can write attacker-controlled bytes to any path the Sessions service can reach: ``/etc/cron.d/`` for a scheduled command, ``/root/.ssh/authorized_keys`` for persistence, ``/usr/local/lib/python3.11/site-packages/<existing>.py`` to backdoor a library imported by the next session, or ``../../app/S
Weaknesses (CWE)
CWE-95, CWE-94, CWE-22, CWE-73, CWE-1336
Target sectors: technology, financial, government, healthcare, legal, manufacturing, retail, education, energy
Target regions: Global, North America, Europe, Asia-Pacific
Detections & IOCs
As of 2026-07-20, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 22 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, CRITICAL, threat intelligence, cybersecurity, CVE-2026-26030, CVE-2026-25592, T1190, T1199, T1059, T1059.006, T1059.001, T1106, T1204.002, T1505, T1574, T1548