Product:
Data Formulator
Summary
Improper control of code generation in Microsoft Data Formulator allows an unauthorized attacker to execute code over a network. This vulnerability can lead to significant impacts on confidentiality, integrity, and availability. Attackers can exploit this flaw to gain unauthorized access and execute malicious code.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8.8 | CVE-2026-41094 |
Exploitation
To exploit this vulnerability, an attacker must have network access and can leverage the improper control of code generation to inject malicious code. The attack requires user interaction, making it necessary for the victim to engage with the malicious content. Once executed, the attacker can gain control over the affected system and perform unauthorized actions.
Affected Products
- Microsoft Data Formulator: Affected by improper code generation control, allowing for potential code injection attacks.
Mitigation
To mitigate this vulnerability, users should ensure that they are using the latest version of Microsoft Data Formulator and apply any available security updates. Additionally, implementing network security measures and educating users about the risks of interacting with untrusted content can help reduce the likelihood of exploitation.