The Nationwide Info Expertise Growth Company (NITDA) has issued an advisory warning customers and organizations in Nigeria a few high-severity zero-day flaw in Microsoft Workplace.
That is in line with the official communication from NITDA, the federal government company accountable for regulating and growing data know-how in Nigeria.
The alert comes as Microsoft confirms the vulnerability, tracked as CVE-2026-21509, is actively being exploited.
What NITDA mentioned
In keeping with NITDA, the zero-day vulnerability permits attackers to bypass Object Linking and Embedding (OLE) mitigations designed to guard customers from malicious code in Microsoft Workplace.
The flaw carries a CVSS rating of seven.8 and requires a sufferer to open a specifically crafted Workplace doc to be exploited
- “The vulnerability is categorized as a safety function bypass that enables attackers to bypass Object Linking and Embedding (OLE) mitigations designed to guard customers from weak COM/OLE controls.
- “Microsoft confirmed that exploitation requires person interplay, particularly convincing a sufferer to open a specifically crafted Microsoft Workplace doc. The Preview Pane is just not thought of an assault vector. As a result of confirmed exploitation, quick motion is strongly suggested,” the company said.
They famous that profitable exploitation might permit attackers to execute malicious code, compromise techniques, ship malware, steal knowledge, or conduct lateral motion inside a company.
Backstory
Final month, Microsoft publicly disclosed the excessive‑severity zero‑day flaw in its Workplace suite, after its personal safety groups detected energetic exploitation within the wild.
In keeping with experiences, inside days of the emergency out‑of‑band replace being launched to repair the flaw, subtle menace actors, together with Russia‑linked teams akin to APT28 (also called Fancy Bear), have been noticed weaponising the vulnerability to ship malware and conduct focused espionage operations throughout Europe and different areas.
Extra insights
Microsoft recognized the zero-day flaw affecting a number of Workplace merchandise, together with
- Workplace 2016 (32-bit and 64-bit)
- Workplace 2019 (32-bit and 64-bit)
- Microsoft 365 Apps
- Workplace 2021 and later.
Whereas Workplace 2021 and newer variations profit from service-side mitigations, customers should restart their purposes for the safety to take impact.
- To mitigate the danger, NITDA suggested organizations and people to instantly set up the newest out-of-band safety updates for Workplace 2016 and 2019. Customers of Workplace 2021 and later ought to restart their purposes to allow service-side protections.
Additionally they urged Organizations to coach customers in regards to the risks of opening unsolicited Workplace paperwork and implement endpoint safety and e-mail filtering options to cut back publicity.
What it is best to know
NITDA has actively guided Nigerian customers and organizations to reduce IT danger publicity.
- BusinessTimes reported that the Company has beforehand issued advisories to Nigerian customers about new vulnerabilities in ChatGPT that might expose customers to data-leakage assaults.
- In previous alerts, the company guided WhatsApp customers on recovering hacked accounts, securing group chats, and implementing two-step verification to stop unauthorized entry.
The company additionally warned Nigerians about vulnerabilities in embedded SIM (eSIM) playing cards, playing cards utilized in smartphones, tablets, wearables and IoT gadgets.
