CVEs / CVE-2026-26030
CVE-2026-26030
Semantic Kernel, Microsoft's semantic kernel Python SDK, has a remote code execution vulnerability in versions prior to 1.39.4, specifically within the `InMemoryVectorStore` filter functionality. The problem has been fixed in version `python-1.39.4`. Users should upgrade this version or higher. As a workaround, avoid using `InMemoryVectorStore` for production scenarios.
Affected products · 1
| Product | Versions affected | Fixed in |
|---|---|---|
| Semantic Kernel | < 1.39.4 | 1.39.4 |
Versions as NVD's CPE configuration states them; "—" means the record gives no fixed version, not that none exists. Check the vendor's advisory in the references.
In this registry
- Microsoft Semantic Kernel — agent dossier
References · 3
- github.com/microsoft/semantic-kernel/pull/13505 — Issue Tracking, Patch
- github.com/microsoft/semantic-kernel/releases/tag/python-1.39.4 — Release Notes
- github.com/microsoft/semantic-kernel/security/advisories/GHSA-xjw9-4gw8-4rqx — Patch, Vendor Advisory
The official record's references, as NVD lists them, minus any tagged Exploit. Nothing here is an exploit or a proof of concept.
Description, scores, versions and references are the official CVE record's own, retrieved 2026-10-25 from NVD. Category, attack surface and cross-links are this registry's classification and can be wrong — use the button above. Not a severity assessment for your deployment.