Critical RCE in Microsoft Semantic Kernel Python SDK

Executive Summary

A maximum-severity (CVSS 10.0) code injection vulnerability has been discovered in Microsoft's Semantic Kernel Python SDK, the company's primary AI orchestration framework used to build applications powered by large language models. The vulnerability resides in the InMemoryVectorStore filter functionality and allows an authenticated attacker with low privileges to execute arbitrary code on the host system.

CVSS Score: 10.0 (Critical)

Organizations using Semantic Kernel for AI-powered applications should upgrade to python-1.39.4 immediately.

Vulnerability Overview

Root Cause

CVE-2026-26030 is an Improper Control of Generation of Code vulnerability (CWE-94) in the InMemoryVectorStore filter mechanism. The filter functionality does not properly sanitize user-supplied filter expressions before evaluating them, allowing an attacker to inject and execute arbitrary Python code.

Affected Versions and Patches

Why This Is Critical

Semantic Kernel's Role

Microsoft's Semantic Kernel is the core AI orchestration layer used to build intelligent applications. It connects LLMs (like Azure OpenAI, GPT-4, etc.) to enterprise data and services. Organizations use it for:

• AI-powered chatbots with access to internal knowledge bases
• Retrieval Augmented Generation (RAG) pipelines using vector stores
• Automated workflows that combine AI reasoning with business logic
• Enterprise copilot applications

The InMemoryVectorStore Attack Surface

The InMemoryVectorStore is used for semantic search — finding relevant documents based on meaning rather than keywords. The filter mechanism allows developers to narrow search results based on metadata criteria. The vulnerability means an attacker who can influence filter parameters can execute arbitrary code.

Attack Scenario

1. Attacker authenticates to an application built on Semantic Kernel
2. Application uses InMemoryVectorStore for semantic search
3. Attacker crafts a malicious filter expression
4. Filter expression is evaluated without proper sanitization
5. Arbitrary Python code executes on the application server
6. Attacker gains full control of the host system

Exploitation Status

While no public exploit or in-the-wild exploitation has been confirmed, the vulnerability's characteristics make exploitation trivially easy once an attacker understands the filter mechanism.

Immediate Remediation

Upgrade Now

pip install semantic-kernel>=1.39.4

If Immediate Upgrade Is Not Possible

1. Do not use InMemoryVectorStore in production environments
2. Switch to an alternative vector store implementation (Azure Cognitive Search, Pinecone, etc.)
3. Restrict network access to Semantic Kernel applications
4. Audit filter inputs — Implement application-level input validation before passing filters to the vector store
5. Monitor for anomalous code execution from Python processes running Semantic Kernel

Detection

Behavioral Indicators

Broader AI Security Implications

This vulnerability highlights a growing trend: AI frameworks introduce novel attack surfaces that traditional application security does not adequately address:

• Vector store queries are not subject to the same input validation scrutiny as SQL queries
• AI orchestration layers often have broad system access to serve as integration hubs
• Semantic search filters are a new class of injection vector unique to AI applications
• The rush to deploy AI means many organizations skip security review of AI framework configurations

Key Takeaways

1. CVSS 10.0 — Maximum severity, trivially exploitable with low privileges
2. Microsoft Semantic Kernel Python SDK before 1.39.4 is affected
3. InMemoryVectorStore filter allows code injection leading to full system compromise
4. Upgrade to python-1.39.4 immediately
5. AI frameworks are the new attack surface — Apply the same security rigor to AI components as to traditional application code

References

• GitLab Advisory — CVE-2026-26030
• CISA — Vulnerability Summary for the Week of February 2, 2026

Related Reading

• GitHub Copilot Command Injection Flaws Enable Remote Code
• Microsoft Exchange Server SSRF to RCE Chain Actively
• Microsoft Releases Windows 11 OOB Hotpatch to Fix Three