Microsoft data formulator vulnerabilities

Latest Microsoft data formulator CVEs

Newest publication first

1. CVE-2026-41094 Microsoft Data Formulator Remote Code Execution Vulnerability

   Published 2026-05-12

   High·CVSS 8.8 EPSS 0.84%

   Improper control of generation of code ('code injection') in Microsoft Data Formulator allows an unauthorized attacker to execute code over a network.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.