CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Microsoft Semantic Kernel

product · product:microsoft-semantic-kernel

Coverage
1
first 2026-05-10 → last 2026-10-11
Latest activity
2026-05-10
Microsoft shows how two Semantic Kernel flaws turned prompts into shells on the agent host; both were patched…
Peak priority
notable
1 notable
Targets
·
no sector or region stated
Sources cited
3
2 hosts

Defender insights

What each entry about Microsoft Semantic Kernel tells a defender to do, newest first.

2026-05-10NOTABLEMicrosoft shows how two Semantic Kernel flaws turned prompts into shells on the agent host; both were patched in February

Exposure · detection

Story timeline

  1. 2026-05-10Microsoft Semantic Kernel CVE-2026-26030 / CVE-2026-25592: prompt injection reaches eval() and the host Startup folder in an AI agent framework, fixed since February
    trending-vulnerabilitiesMicrosoft shows how two Semantic Kernel flaws turned prompts into shells on the agent host; both were patched in February

Hunting pivots

CVEs
CVE-2026-25592CVE-2026-26030
Releases covered
Microsoft Semantic Kernel
Tags
ai-abusecloudpatch-availablepoc-publicrcevulnerabilities
ATT&CK techniques (5 across 4 tactics)

5 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v19.2 · compare on the matrix · Navigator layer (JSON)

  • ExecutionCommand and Scripting Interpreter: Python · Exploitation for Client Execution
  • PersistenceBoot or Logon Autostart Execution: Registry Run Keys / Startup Folder
  • Privilege EscalationBoot or Logon Autostart Execution: Registry Run Keys / Startup Folder · Escape to Host
  • CollectionData from Local System

Execution TA0002

T1059.006Command and Scripting Interpreter: Python×1

Adversaries may abuse Python commands and scripts for execution. Python is a very popular scripting/programming language, with capabilities to perform many functions. Python can be executed interactively from the command-line (via the <code>python.exe</code> interpreter) or via scripts (.py) that can be written and distributed to different systems. Python code can also be compiled into binary executables.

Evidence: 2026-05-10/microsoft-semantic-kernel-cve-2026-26030-cve-2026-25592-prom · ATT&CK page ↗

T1203Exploitation for Client Execution×1

Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.

Evidence: 2026-05-10/microsoft-semantic-kernel-cve-2026-26030-cve-2026-25592-prom · ATT&CK page ↗

Persistence TA0003

T1547.001Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder×1

Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.

Evidence: 2026-05-10/microsoft-semantic-kernel-cve-2026-26030-cve-2026-25592-prom · ATT&CK page ↗

Privilege Escalation TA0004

T1547.001Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder×1

Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.

Evidence: 2026-05-10/microsoft-semantic-kernel-cve-2026-26030-cve-2026-25592-prom · ATT&CK page ↗

T1611Escape to Host×1

Adversaries may break out of a container or virtualized environment to gain access to the underlying host. This can allow an adversary access to other containerized or virtualized resources from the host level or to the host itself. In principle, containerized / virtualized resources should provide a clear separation of application functionality and be isolated from the host environment.

Evidence: 2026-05-10/microsoft-semantic-kernel-cve-2026-26030-cve-2026-25592-prom · ATT&CK page ↗

Collection TA0009

T1005Data from Local System×1

Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.

Evidence: 2026-05-10/microsoft-semantic-kernel-cve-2026-26030-cve-2026-25592-prom · ATT&CK page ↗

Entries about Microsoft Semantic Kernel (1)

2026-05-10 · view entry permalink →

NOTABLECVE-2026-26030 +1updatedNATOA2

Microsoft Semantic Kernel CVE-2026-26030 / CVE-2026-25592: prompt injection reaches eval() and the host Startup folder in an AI agent framework, fixed since February

Microsoft's Defender research team published on 2026-05-07 how two Semantic Kernel flaws turn a prompt injection into code execution on the host running an AI agent (Microsoft Security Blog, 2026-05-07). Both were fixed months earlier: CVE-2026-25592 in February (GitHub Security Advisory GHSA-2ww3-72rp-wpp4, 2026-02-06) and CVE-2026-26030 later the same month (GitHub Security Advisory GHSA-xjw9-4gw8-4rqx, 2026-02-19).

CVE-2026-26030 (Python semantic-kernel before 1.39.4) sits in the In-Memory Vector Store filter behind the Search Plugin: in the default configuration the filter is a Python lambda executed with eval(), and an AI-controlled value is interpolated into it (Microsoft Security Blog, 2026-05-07). Microsoft's exploit prompt escaped the template string, traversed Python's class hierarchy to BuiltinImporter, loaded os and called system(), bypassing the AST-based blocklist; the fix adds node-type and function-call allowlists and blocks class-hierarchy attributes (Microsoft Security Blog, 2026-05-07). The attack needs a prompt-injection vector and the Search Plugin backed by the In-Memory Vector Store in its default configuration (Microsoft Security Blog, 2026-05-07), and the advisory advises against using the In-Memory Vector Store in production (GitHub Security Advisory GHSA-xjw9-4gw8-4rqx, 2026-02-19).

CVE-2026-25592 (.NET Microsoft.SemanticKernel.Plugins.Core before 1.71.0) exposed DownloadFileAsync to the model as a kernel function, so a prompt could have the agent write a script created inside the Azure Container Apps sandbox into the host's Windows Startup folder, where it runs at the next sign-in; upload_file in both SDKs similarly accepted any local path, allowing host files to be read out (Microsoft Security Blog, 2026-05-07). The advisory's workaround is a Function Invocation Filter that allow-lists localFilePath for the download and upload functions (GitHub Security Advisory GHSA-2ww3-72rp-wpp4, 2026-02-06). No source reports exploitation.

Correctionrun 2026-10-11T1307Z-audittitleheadlinesummarytechniquesaffected_productscvessourcesclassificationbodydeep_divedeep_dive_category

In CVE-2026-25592, DownloadFileAsync is what writes attacker content to the host, including the Startup folder, and upload_file is what reads host files out (Microsoft Security Blog, 2026-05-07); the earlier text had the two reversed. CVE-2026-26030 passes an interpolated lambda to eval() behind an AST-based blocklist, which Microsoft bypassed through BuiltinImporter (Microsoft Security Blog, 2026-05-07). The fixes were published in February (GitHub Security Advisory GHSA-xjw9-4gw8-4rqx, 2026-02-19) (GitHub Security Advisory GHSA-2ww3-72rp-wpp4, 2026-02-06), three months before Microsoft's write-up.

vulnerability10 May 05:00Zmulti-sourceOpen finding →
Sources: Microsoft Security Blog · GitHub Security Advisory GHSA-xjw9-4gw8-4rqx · GitHub Security Advisory GHSA-2ww3-72rp-wpp4

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • github.com2 (67%)
  • microsoft.com1 (33%)
All cited sources (3)