closedclosed 5 Mar 2026Research1 Research / proof of conceptAI
RCE Vulnerability in Microsoft Semantic Kernel Search Plugin
Semantic Kernel
Researchers discovered a path in Microsoft Semantic Kernel where a single prompt injection could lead to host-level remote code execution. The vulnerability affects agents using the Search Plugin backed by the In-Memory Vector Store.
- CVSS
- 9.9
- EPSS
- 0.04 · top 10% · 2026-11-13
- first report
- 19 Feb 2026
- last update
- 30 Jun 2026
- CVE ids
Timeline · 4
Sources · 4
Advisories and databases
- 2026-02-19CVE-2026-26030: Microsoft Semantic Kernel InMemoryVectorStore filter functionality vulnerable to remote code executionGitHub Advisory Database · github.com/advisories/GHSA-xjw9-4gw8-4rqx
- 2026-06-30When prompts become shells: RCE vulnerabilities in AI agent frameworksMicrosoft Security · microsoft.com/en-us/security/blog/2026/05/07/prompts-become-shells-rce-vulnerabi
News and write-ups
- 2026-06-30CVE-2026-26030cve.org · cve.org/CVERecord?id=CVE-2026-26030
Research and catalogues
- 2026-06-30RCE Vulnerability in Semantic Kernel Search PluginMITRE ATLAS · atlas.mitre.org/studies/AML.CS0062
Titles and links belong to their publishers. The summary above is written by gcdRadar in its own words; data is CC BY-SA 4.0.
Classification
- lane
- Research
- AI role
- Attack on AI
- categories
- Prompt injectionInfrastructure vulnerabilityAgent hijack
- severity
- 1 · Research / proof of concept
- targets
- Microsoft, Framework / tooling
- dates
- happened 7 May 2026 · first reported 19 Feb 2026
- origin
- MITRE ATLASDerived from MITRE ATLAS (Apache 2.0, © MITRE).
- record
- confidence 0.95 · created 2026-10-18 06:55Z · updated 2026-10-18 07:00Z
Lane, AI role, categories and severity come from the classifier; the OWASP and ATLAS rows are derived from the categories. How these are assigned
Copy a brief
This record as a short Markdown brief, for a ticket, a chat or a coding agent.
the brief as text
# RCE Vulnerability in Microsoft Semantic Kernel Search Plugin https://gcdradar.vercel.app/incidents/rce-vulnerability-in-microsoft-semantic-kernel-search-plugin · AIR-2026-0352 · closed 2026-03-05 - Lane: Research - Severity: 1 (Research / proof of concept) - Fix status: Fix status unknown - First reported: 2026-02-19 (happened 2026-05-07) - AI role: Attack on AI - Products: Semantic Kernel - CVE ids: CVE-2026-26030 - CVSS: 9.9 ## Summary Researchers discovered a path in Microsoft Semantic Kernel where a single prompt injection could lead to host-level remote code execution. The vulnerability affects agents using the Search Plugin backed by the In-Memory Vector Store. ## What to do No action recorded; read the sources below and the vendor's advisory. ## Latest updates - 2026-06-30: CVE-2026-26030 (https://cve.org/CVERecord?id=CVE-2026-26030) - 2026-06-30: When prompts become shells: RCE vulnerabilities in AI agent frameworks (https://microsoft.com/en-us/security/blog/2026/05/07/prompts-become-shells-rce-vulnerabilities-ai-agent-frameworks) - 2026-06-30: RCE Vulnerability in Semantic Kernel Search Plugin (https://atlas.mitre.org/studies/AML.CS0062) - 2026-02-19: CVE-2026-26030: Microsoft Semantic Kernel InMemoryVectorStore filter functionality vulnerable to remote code execution (https://github.com/advisories/GHSA-xjw9-4gw8-4rqx) ## Sources - 2026-02-19 GitHub Advisory Database: CVE-2026-26030: Microsoft Semantic Kernel InMemoryVectorStore filter functionality vulnerable to remote code execution https://github.com/advisories/GHSA-xjw9-4gw8-4rqx - 2026-06-30 MITRE ATLAS: RCE Vulnerability in Semantic Kernel Search Plugin https://atlas.mitre.org/studies/AML.CS0062 - 2026-06-30 Microsoft Security: When prompts become shells: RCE vulnerabilities in AI agent frameworks https://microsoft.com/en-us/security/blog/2026/05/07/prompts-become-shells-rce-vulnerabilities-ai-agent-frameworks - 2026-06-30 cve.org: CVE-2026-26030 https://cve.org/CVERecord?id=CVE-2026-26030 Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.
Related
- closed9.8Langflow CVE-2026-27966: Langflow Remote Code Execution in CSV Agent
Patch now · Disclosed · since 27 Feb 2026 · updated 27 Feb 2026 · CVE-2026-27966
AI - closed9.5Flowise Flowise CSV Agent prompt injection leads to remote code execution
Patch now · Disclosed · since 4 Aug 2026 · CVE-2026-70477
AI - closed8.3Langflow CVE-2026-107366: IBM Langflow OSS lacks ownership verification on message endpoints enabling session hijacking
Patch now · Disclosed · since 20 Oct 2026 · CVE-2026-107366
AI - closed7.5GitHub Copilot GitHub Copilot CLI shell tool arbitrary code execution vulnerability
Patch now · Disclosed · since 6 Mar 2026 · CVE-2026-29783
AI - closed6.6MCP servers & tools CVE-2026-44192: Path Traversal Flaw in Ansible Lightspeed MCP Server
Patch now · Disclosed · since 22 Jul 2026 · CVE-2026-44192
AI - closed9.9Semantic Kernel CVE-2026-25592: Semantic Kernel Arbitrary File Write Vulnerability
Patch now · Disclosed · since 6 Feb 2026 · CVE-2026-25592
AI