---

TL;DR

Microsoft disclosed CVE-2026-26030 (CVSS 9.8), a critical remote code execution vulnerability in Semantic Kernel Python SDK that allows attackers to execute arbitrary code through prompt injection in vector store filter expressions. The vulnerability affects all versions prior to 1.39.4 and targets AI agent infrastructure directly, not web endpoints.

Key Facts

• Who: Microsoft Security Response Center, affecting Semantic Kernel SDK users
• What: Critical RCE vulnerability (CVSS 9.8) enabling arbitrary code execution via prompt injection
• When: Disclosed May 7, 2026; patches available immediately
• Impact: All AI applications using Semantic Kernel Python SDK < 1.39.4 or .NET SDK < 1.71.0

What Changed

Microsoft’s Security Response Center disclosed a critical remote code execution vulnerability in Semantic Kernel, its open-source SDK for building AI agents. CVE-2026-26030 carries a CVSS severity score of 9.8 out of 10, making it one of the most severe AI framework vulnerabilities disclosed in 2026.

The vulnerability resides in the InMemoryVectorStore component, where malicious filter expressions can be injected through user prompts. Unlike traditional injection attacks that target web application endpoints, this attack chain converts natural language input into executable Python code through the agent’s internal filter parsing logic.

“An attacker who successfully exploited this vulnerability could run arbitrary code in the context of the application,” Microsoft stated in its security advisory. “This could allow the attacker to install programs; view, change, or delete data; or create new accounts with full user rights.”

A second vulnerability, CVE-2026-25592, affects the .NET SDK with a path traversal flaw. Both vulnerabilities were patched in Semantic Kernel Python version 1.39.4 and .NET version 1.71.0, released immediately upon disclosure.

Security researchers from Nuka-AI disclosed multiple bypass vectors for the initial February patches, prompting the May disclosure and additional hardening measures.

Why It Matters

The attack chain mechanics distinguish this vulnerability from traditional web security threats:

Attack Vector	Traditional XSS	Semantic Kernel RCE
Entry Point	Web form input	Agent prompt input
Target Layer	Browser DOM	Python/.NET runtime
Execution Context	Client-side JavaScript	Server-side code
Blast Radius	User session	Application server
Exploitation Complexity	Medium	Low

Attack Chain Breakdown:

1. Prompt Input: Attacker crafts a natural language prompt containing malicious filter syntax
2. Filter Expression: The prompt is passed to InMemoryVectorStore.filter() without proper sanitization
3. Code Execution: Filter expression is evaluated as Python code via eval() or equivalent
4. Runtime Access: Attacker gains arbitrary code execution on the server hosting the AI agent

The vulnerability class is particularly concerning because:

• No Input Validation Bypass Required: The filter expression syntax is intended functionality, making detection difficult
• Agent-Specific Attack Surface: Traditional WAF rules do not inspect agent prompt flows
• High Trust Context: AI agents often run with elevated permissions to access tools, APIs, and databases
• Supply Chain Implications: Organizations embedding Semantic Kernel in production agents face immediate exposure

According to Microsoft’s security blog, the attack requires no authentication for applications that accept untrusted prompts, which includes most customer-facing AI agent deployments.

🔺 Scout Intel: What Others Missed

Confidence: high | Novelty Score: 82/100

The deeper security implication extends beyond the immediate patch. This vulnerability represents a new attack class: prompt-to-code translation exploits. Traditional security models assume a boundary between user input and code execution, but AI agent frameworks deliberately blur this boundary through natural language interfaces. Semantic Kernel’s filter expression mechanism is not a bug—it’s a feature designed to let developers write expressive queries. The vulnerability exploits this intentional design pattern, making it difficult to distinguish legitimate use from malicious injection without breaking functionality.

Key Implication: Enterprise security teams must audit all AI agent frameworks—not just Semantic Kernel—for similar prompt-to-code translation patterns. LangChain, CrewAI, and OpenAI’s Agents SDK all implement comparable filter/search mechanisms that may contain equivalent vulnerabilities. The attack surface is architectural, not incidental.

What This Means

For AI Application Developers

Immediate action is required for any application using Semantic Kernel Python SDK before version 1.39.4 or .NET SDK before version 1.71.0. The patch introduces strict input sanitization for filter expressions, but developers should additionally:

• Implement prompt content filtering before filter expression generation
• Audit agent permissions and apply principle of least privilege
• Enable audit logging for all filter expression evaluations
• Consider sandboxing agent runtimes in containerized environments

For Enterprise Security Teams

This disclosure should trigger a broader audit of AI agent infrastructure:

1. Inventory all AI frameworks in production environments, including Semantic Kernel, LangChain, CrewAI, AutoGen, and OpenAI Agents SDK
2. Review prompt handling code for similar filter expression patterns
3. Update security monitoring to include agent prompt flows, which traditional WAFs do not inspect
4. Assess blast radius: Agents with database, API, or file system access multiply the potential impact

What to Watch

Microsoft’s disclosure may be the first of many in this vulnerability class. Security researchers at Nuka-AI have demonstrated that the attack pattern is replicable across multiple agent frameworks. Expect additional CVEs targeting prompt-to-code translation mechanisms in competing AI agent SDKs throughout 2026.

Related Coverage:

• NVIDIA Rubin Platform: Six Chips, 10x Token Cost Reduction — Infrastructure implications for AI deployment economics
• LangCrew: High-Level Multi-Agent Framework on LangGraph — Alternative framework comparison for agent development

Sources

• Microsoft Security Blog: Prompts Become Shells — Microsoft, May 7, 2026
• Vibe Graveyard: Semantic Kernel Prompt Injection RCE — Security Research Analysis, May 2026
• Windows News: CVE-2026-26030 Critical RCE — Technical Analysis, May 2026