cve 2026 41094

CVE-2026-41094 is a remote code execution vulnerability in Microsoft Data Formulator, a tool that creates AI-assisted data visualizations and exploratory analysis. Microsoft listed the flaw in its Security Update Guide on May 12, 2026. The vulnerability is notable because Data Formulator operates at the intersection of uploaded data, generated code, local services, databases, and large-language-model workflows. While Microsoft's advisory is brief, the classification raises concerns about how experimental AI tools can become production-adjacent software. Administrators should assess their exposure to this vulnerability and apply any available patches or mitigations to reduce risk.