Semantic Kernel vulnerabilities show how agent frameworks magnify prompt injection
Microsoft fixed two critical Semantic Kernel flaws that could turn prompt injection into code execution in specific agent setups.
By Dominic Okoye · Staff Writer
· 3 min read
Microsoft has disclosed and fixed two critical Semantic Kernel vulnerabilities, CVE-2026-25592 and CVE-2026-26030, that could enable unauthorized code execution through injection attacks against affected agents. The cases put a narrower point behind the prompt-injection debate: injection remains the way an attacker influences an agent, while insecure framework and tool handling can turn that influence into execution.
Semantic Kernel is Microsoft’s open-source framework for building agents and connecting AI models to applications. Microsoft says agents with plugins can read files, search databases, run scripts and operate across a network. That capability changes the outcome of a bad instruction: a model-controlled tool parameter can become more than a bad answer if the surrounding software trusts it improperly.
Which Semantic Kernel configurations were exposed to CVE-2026-26030?
Microsoft says exploiting CVE-2026-26030 required two conditions: a prompt-injection route into the agent and use of the Search Plugin backed by the In-Memory Vector Store under its default configuration. The company did not say that every Semantic Kernel deployment met those conditions.
In the affected path, Microsoft said the default filter assembled a Python lambda expression and executed it with eval(). A parameter controlled by the AI model was not sanitized before entering that expression. Microsoft said an abstract-syntax-tree validator was intended to limit risky code, but the underlying path could let an injection attack reach remote code execution. Both disclosed flaws have been fixed, according to Microsoft.
The technical distinction matters for teams treating prompt injection as a model-alignment problem. A language model processes text and selects tools; the framework decides how its output is translated into calls, parameters, state and executable system behavior. Microsoft describes the vulnerability as misplaced trust in parsed data by the framework and tools, rather than the model’s basic ability to map language to a tool schema.
Why can AI agent framework flaws affect more than one app?
Agent frameworks are shared orchestration layers. A defect in a common way of passing model outputs into tools can therefore recur across applications built on the same layer, though the impact still depends on each application’s configuration, permissions and exposed tools.
That broader pattern is not limited to Semantic Kernel. Check Point researchers told The Register they spent a year testing LangChain, LangGraph, CrewAI, AutoGen, Microsoft Agent Framework and Google ADK, finding and disclosing 11 vulnerabilities. The researchers said the findings included familiar software-security categories such as insecure deserialization, server-side request forgery, path traversal and use-after-free. Those results are researchers’ findings, not a count of all agent-framework flaws.
For operators, the immediate work is conventional security engineering. Patch affected framework versions and identify agents that read externally influenced content while holding access to sensitive systems. AWS recommends separating agents that process untrusted material from those that orchestrate trusted actions, limiting the former to read-only and least-privilege permissions, and requiring approval for irreversible steps. Its guidance also calls for sandboxed runs, protected branches and pull-request review for coding agents. Those controls fit the wider principle that enterprise security is a program, not a product: model safeguards do not replace access boundaries and software patching.
This story draws on original reporting from The Register.
