CVE-2026-25592criticalCWE-22

CVE-2026-25592: fallo crítico en microsoft semantic-kernel

Semantic Kernel has an Arbitrary File Write via AI Agent Function Calling in .NET SDK

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear semantic-kernel+ Monitorear semantic-kernel

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

28Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 10epss 2.5%
Semantic Kernel is an SDK used to build, orchestrate, and deploy AI agents and multi-agent systems. Prior to 1.71.0, an Arbitrary File Write vulnerability has been identified in Microsoft's Semantic Kernel .NET SDK, specifically within the SessionsPythonPlugin. The problem has been fixed in Microsoft.SemanticKernel.Core version 1.71.0. As a mitigation, users can create a Function Invocation Filter which checks the arguments being passed to any calls to DownloadFileAsync  or UploadFileAsync and ensures the provided localFilePath is allow listed.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Productos afectados
microsoft · semantic-kernel
CVEs relacionadas — microsoft semantic-kernel

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-26030CRITICALMicrosoft Semantic Kernel InMemoryVectorStore filter functionality vulnerable to remote code executionEPSS 3.9%