10.0 CriticalCWE-94
CVE-2026-26030
microsoft semantic-kernel vulnerability
microsoftsemantic-kernel
Status
- Not in CISA KEV
- Vendor fix available
Exploit probabilityEPSSchecked 24 Oct
4.1%probability of exploitation in the next 30 days
Higher than 91% of scored CVEs
SeverityCVSS
10.0Critical
Description NVD
Semantic Kernel, Microsoft's semantic kernel Python SDK, has a remote code execution vulnerability in versions prior to 1.39.4, specifically within the `InMemoryVectorStore` filter functionality. The problem has been fixed in version `python-1.39.4`. Users should upgrade this version or higher. As a workaround, avoid using `InMemoryVectorStore` for production scenarios.
Coverage 1 article · 1 outlet
- When prompts become shells: RCE vulnerabilities in AI agent frameworksMicrosoft · first in our coverage