PT-2026-20868 · Microsoft · Inmemoryvectorstore+1

CVE-2026-26030

Published

2026-02-19

Updated

2026-07-17

CVSS v3.1

9.9

Critical

Vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Semantic Kernel Python SDK versions prior to 1.39.4

Description A remote code execution issue exists within the InMemoryVectorStore filter functionality.

Recommendations Update to version 1.39.4 or higher. As a temporary workaround, avoid using InMemoryVectorStore for production scenarios.

Exploit

Fix

RCE

Code Injection

Found an issue in the description? Have something to add? Feel free to write us 👾

CVE-2026-26030

GHSA-XJW9-4GW8-4RQX

PYSEC-2026-163

Inmemoryvectorstore

Semantic-Kernel