CVE-2026-26030
Microsoft Semantic Kernel InMemoryVectorStore filter functionality vulnerable to remote code execution
Vexday Risk Score
48Attention
SSVC decision (CISA)
Attend
PoC available → attend closely
CVSS 10EPSS 2.9%KEV nãoPoC públicaNuclei —Metasploit —Patch —
Lifecycle
19 Feb 2026Published on NVD
22 Jun 2026Public PoC
Recommendation: Plan a near-term fix — a public PoC already exists.
Semantic Kernel, Microsoft's semantic kernel Python SDK, has a remote code execution vulnerability in versions prior to 1.39.4, specifically within the `InMemoryVectorStore` filter functionality. The problem has been fixed in version `python-1.39.4`. Users should upgrade this version or higher. As a workaround, avoid using `InMemoryVectorStore` for production scenarios.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected products
microsoft · semantic-kernelpublic PoCs found — 1
githubgithub.com/InertFluid/sk-cve-2026-26030-lab★ 1⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Want to know if your infrastructure is exposed to this?
Talk to TrueHacking →