Microsoft Semantic Kernel RCE (CVE-2026-26030)
Date: 2026-03
Affected: Microsoft Semantic Kernel RCE (CVE-2026-26030)
Attack vector: rce
Category: real-world
Severity: Critical
CVE: CVE-2026-26030
CWE: CWE-94
CVSS:  (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)

CVSS 9.9. Critical RCE in Microsoft Semantic Kernel Python SDK's InMemoryVectorStore filter functionality. Attackers execute arbitrary code through crafted filter expressions. Semantic Kernel powers many Microsoft Copilot integrations and RAG-based AI applications. Fixed in python-1.39.4.


Mitigations:

Architectural layers (MAESTRO):