Executive Summary
Microsoft disclosed two critical, now-fixed Semantic Kernel vulnerabilities, CVE-2026-25592 and CVE-2026-26030, that could turn prompt injection into host-level remote code execution in agents built on the framework.
What Happened
Microsoft disclosed two critical Semantic Kernel vulnerabilities, CVE-2026-25592 and CVE-2026-26030, that could allow attackers to turn prompt injection into host-level remote code execution. The post explains that the flaws were fixed and affect agents built on the framework.
Affected Products
- Microsoft Semantic Kernel
Vulnerability / Attack Technique
Prompt injection escalating to host RCE
Technical Mechanism
Injected instructions could reach framework functions that execute code on the host running the agent.
AI Security Category
LLM01:2025 Prompt Injection
Part of the Prompt Injection topic.
Relevant Frameworks
RealGround Analysis
Framework bugs decide how bad a prompt injection gets. RealGround analysis: keep agent frameworks patched and run agents with minimal host privileges.
Recommended Controls
- Update Semantic Kernel to fixed versions
- Run agents as unprivileged users in containers
- Avoid exposing code-execution plugins to untrusted input
Related RealGround Service
Secure AI Agent Build · or start with the free AI Agent Security Scanner.
Sources
Microsoft Security Blog: https://www.microsoft.com/en-us/security/blog/2026/05/07/prompts-become-shells-rce-vulnerabilities-ai-agent-frameworks/
Summary and analysis written by RealGround from the source above; last updated 2026-10-17.