What is CVE-2026-26030?

CVE-2026-26030 is a security advisory published by Microsoft Security Response Center (MSRC) with High severity. GitHub: CVE-2026-26030 Microsoft Semantic Kernel InMemoryVectorStore filter functionality vulnerable

Which CVE IDs does CVE-2026-26030 cover?

CVE-2026-26030 covers the following CVE IDs: CVE-2026-26030. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of CVE-2026-26030?

CVE-2026-26030 has a CVSS v3 base score of 9.9, published by Microsoft Security Response Center (MSRC).

Which products are affected by CVE-2026-26030?

CVE-2026-26030 affects 1 product, including: Microsoft Semantic Kernel Python SDK.

CVE-2026-26030HighCVSS 9.9

GitHub: CVE-2026-26030 Microsoft Semantic Kernel InMemoryVectorStore filter functionality vulnerable

Vendor

Microsoft Security Response Center (MSRC)

Published

May 31, 2026

Last Modified

—

🔗 CVE IDs covered (1)

CVE-2026-26030 →

📋 Description

CVE-2026-26030 is a Remote Code Execution vulnerability that has been identified in Microsoft Semantic Kernel Python SDK, specifically within the InMemoryVectorStore filter functionality. GitHub created this CVE on their behalf. GitHub created this CVE on their behalf. This document incorporates updates in the Microsoft Semantic Kernel Repository which address this vulnerability. Please see CVE-2026-26030 for more information.

🎯 Affected products1

Microsoft Semantic Kernel Python SDK

✅ Remediation

KBRelease Notes (Source Code (.zip)) — fixed build 1.39.4 KBRelease Notes (Source Code (tar.gz)) — fixed build 1.39.4

🔗 References (4)

advisoryhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26030
patchhttps://github.com/microsoft/semantic-kernel/archive/refs/tags/python-1.39.4.zip
referencehttps://github.com/microsoft/semantic-kernel/releases/tag/python-1.39.4
patchhttps://github.com/microsoft/semantic-kernel/archive/refs/tags/python-1.39.4.tar.gz