Microsoft patches two critical vulnerabilities (CVE-2026-25592 and CVE-2026-26030) in its Semantic Kernel framework that could allow full remote code execution.
What these flaws put at risk
Microsoft has patched two critical vulnerabilities in Semantic Kernel—CVE-2026-25592 and CVE-2026-26030—that could allow full remote code execution. Semantic Kernel sits between application code and model providers: it plans steps, selects tools, and runs plugins on the host. When that layer is compromised, an attacker is not limited to a bad chat response. They can reach process memory, local files, network credentials, and whatever systems the app identity can touch.
RCE in an orchestration framework is especially serious because these services often hold long-lived secrets, call internal APIs, and run with broader privileges than a single model call. A successful exploit can turn a text-generation path into a shell on the machine that hosts the kernel.
How orchestration layers get exposed
Semantic Kernel is designed to connect natural-language intent to executable actions. Plugins, planners, and prompt templates can pass model output into code paths that open files, run commands, or invoke remote services. If input is not strictly validated, or if a planner can choose tools beyond a tight allowlist, untrusted content becomes executable influence.
That risk grows when agents are internet-facing, when prompts include user or third-party data, or when auto-invocation runs without a human gate. Multi-tenant or shared-host setups make impact worse: one compromised session may share the same runtime and credentials as other workloads.
What to do right now
- Apply Microsoft’s Semantic Kernel security updates as soon as they are available for your package ecosystem, and redeploy every service that embeds the framework.
- Inventory every app, service, and notebook that imports Semantic Kernel—including internal tools and CI jobs that may lag behind production.
- Rotate API keys, connection strings, and cloud credentials that the kernel process could have accessed if exploitation was possible before patching.
- Review logs for unusual plugin use, unexpected process starts, outbound connections, or changes to local files around the time the issues became known.
- Temporarily disable or tightly gate auto tool invocation on public endpoints until patches are confirmed in every environment.
Treat this as a full application update, not a library bump. Staging, canaries, and local developer machines need the same fix as production. After deploy, verify the running image or package lockfile actually contains the patched build.
Hardening agent stacks beyond the patch
Patches close known holes; design reduces the next one. Run Semantic Kernel under least privilege: a dedicated identity with only the tools and network paths it needs. Prefer explicit tool registration over open-ended discovery. Validate and sanitize model output before it becomes arguments to shell, file, or SQL operations. Keep untrusted prompts in a sandbox or separate process that cannot write production secrets.
Add monitoring that treats plugin execution as a security event: which tool ran, with which arguments, from which session, and whether it left the expected network boundary. If you cannot answer those questions from logs today, fix observability before the next critical RCE lands. For teams building on Semantic Kernel, the practical takeaway is simple: update now, shrink what the kernel can touch, and never let model output become code without an explicit, audited boundary.