Critical severity · published Feb 6, 2026
CVE-2026-25592
Semantic Kernel has an Arbitrary File Write via AI Agent Function Calling in .NET SDK
9.9
CVSS
2.6%
EPSS
No
On KEV
Description
Semantic Kernel is an SDK used to build, orchestrate, and deploy AI agents and multi-agent systems. Prior to 1.71.0, an Arbitrary File Write vulnerability has been identified in Microsoft's Semantic Kernel .NET SDK, specifically within the SessionsPythonPlugin. The problem has been fixed in Microsoft.SemanticKernel.Core version 1.71.0. As a mitigation, users can create a Function Invocation Filter which checks the arguments being passed to any calls to DownloadFileAsync or UploadFileAsync and ensures the provided localFilePath is allow listed.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)2.6% · higher than 85% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SE
semantic-kernel · microsoft
< 1.71.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-25592
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-25592
github.com
https://github.com/microsoft/semantic-kernel/blob/main/dotnet/samples/Demos/CodeInterpreterPlugin/Program.cs#L61-L64
github.com
https://github.com/microsoft/semantic-kernel/pull/13478/changes#diff-88d3cacba2bfa84eef8f2aa171b34f9940338cbb784a3ffc49f5fe3af1b8943d
github.com
https://github.com/microsoft/semantic-kernel/security/advisories/GHSA-2ww3-72rp-wpp4
More from semantic-kernel
9.9
CVE-2026-26030
Microsoft Semantic Kernel InMemoryVectorStore filter functionality vulnerable to remote code execution
