Microsoft Patched Two Semantic Kernel Flaws That Turned Prompt Injection into Remote Code Execution
Microsoft patched two critical vulnerabilities in Semantic Kernel that allowed prompt injection to escalate into full remote code execution on the host machine. CVE-2026-26030, scored CVSS 9.9, exploited a Python eval() call in the In-Memory Vector Store's default filter function. The attack required no browser exploit, no malicious attachment, and no memory corruption. The agent simply processed a crafted prompt, called its search tool, and executed arbitrary code.