Microsoft Semantic Kernel Vulnerability Allows Remote Code Execution via Malicious Agent Plugin Deserialization (CVE-2026-78610)

Executive Summary

The Microsoft Security Response Center (MSRC) has issued an emergency advisory addressing CVE-2026-78610 (CVSS score 9.8), a critical remote code execution vulnerability impacting the Semantic Kernel orchestration framework across both .NET and Python runtimes.

Semantic Kernel serves as the foundational integration layer connecting enterprise Large Language Models (LLMs) with external tools, APIs, and agent plugins. The vulnerability allows an attacker to achieve unauthenticated remote code execution on the underlying host or container by supplying a crafted plugin configuration manifest during automated tool-discovery routines.

Root Cause: Unsafe Reflection and Manifest Deserialization

The root cause lies in how Semantic Kernel handles dynamic tool registration from remote endpoints. When parsing external OpenAPI or custom plugin schemas, the deserialization handler used an unconstrained type loader that accepted arbitrary type discriminators.

By supplying a malicious manifest defining a gadget chain within common standard library classes, threat actors can bypass sandbox boundaries and execute arbitrary system processes with the privileges of the AI application service account.

Exploitation Vector in Multi-Agent Ecosystems

Modern enterprise agent architectures frequently implement autonomous planning loops where an orchestration agent queries a registry to discover and instantiate plugins on the fly. If an agent dynamically resolves tool schemas from an external URI, untrusted third-party repository, or compromised internal microservice, the malicious manifest is automatically parsed without human intervention, leading to immediate host compromise.

Remediation & Defense Playbook

Enterprise AI engineering teams must implement the following controls immediately:

1. Update SDK Packages: Upgrade Microsoft.SemanticKernel to version 1.48.0 or higher in .NET projects and semantic-kernel to 1.32.0 or higher in Python environments.
2. Disable Dynamic Manifest Fetching: Enforce local, pre-compiled plugin registrations rather than pulling dynamic tool schemas across runtime network endpoints.
3. Implement Strict Type Whitelisting: If external plugin schemas must be parsed, enforce strict JSON schema validation with all polymorphic type discrimination explicitly disabled.
4. Container Isolation: Ensure all AI agent runtimes execute within microVMs or rootless containers with dropped Linux capabilities and restricted egress network rules.