CVE-2026-26030

CRITICAL

Microsoft Semantic Kernel <1.39.4 - RCE

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2026-26030. PoCs published by XiaomingX, mbanyamer.

AI-analyzed exploit summary The repository contains a functional PoC for CVE-2026-26030, demonstrating RCE in Microsoft Semantic Kernel < 1.39.4 via unsafe attribute resolution in `InMemoryVectorStore` filter expressions. The exploit leverages Python's `__builtins__` and `globals` traversal to achieve arbitrary code execution.

Description

Semantic Kernel, Microsoft's semantic kernel Python SDK, has a remote code execution vulnerability in versions prior to 1.39.4, specifically within the `InMemoryVectorStore` filter functionality. The problem has been fixed in version `python-1.39.4`. Users should upgrade this version or higher. As a workaround, avoid using `InMemoryVectorStore` for production scenarios.

Exploits (2)

github WORKING POC 10 stars
by XiaomingX · pythonpoc
https://github.com/XiaomingX/data-cve-poc-py-v1/tree/main/2026/CVE-2026-26030

The repository contains a functional PoC for CVE-2026-26030, demonstrating RCE in Microsoft Semantic Kernel < 1.39.4 via unsafe attribute resolution in `InMemoryVectorStore` filter expressions. The exploit leverages Python's `__builtins__` and `globals` traversal to achieve arbitrary code execution.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Microsoft Semantic Kernel < 1.39.4
No auth needed
Prerequisites: Vulnerable version of semantic-kernel installed · Ability to pass untrusted input to filter expressions
devstral-2 · analyzed Feb 27, 2026 Full analysis →
nomisec WORKING POC
by mbanyamer · poc
https://github.com/mbanyamer/CVE-2026-26030-Microsoft-Semantic-Kernel-1.39.4-RCE

This repository contains a functional exploit PoC for CVE-2026-26030, demonstrating remote code execution in Microsoft Semantic Kernel versions < 1.39.4 via unsafe attribute resolution in `InMemoryVectorStore` filter expressions.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Microsoft Semantic Kernel < 1.39.4
No auth needed
Prerequisites: Vulnerable version of semantic-kernel installed · Ability to pass untrusted input to filter expressions
devstral-2 · analyzed Feb 25, 2026 Full analysis →

References (3)

Core 3

Scores

CVSS v3 9.9
EPSS 0.0010
EPSS Percentile 28.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-94
Status published
Products (2)
microsoft/semantic_kernel < 1.39.4
pypi/semantic-kernel 0 - 1.39.4PyPI
Published Feb 19, 2026
Tracked Since Feb 19, 2026