The Nationwide Data Expertise Growth Company (NITDA) has issued an advisory warning customers and organizations in Nigeria a few high-severity zero-day flaw in Microsoft Workplace.
That is in keeping with the official communication from NITDA, the federal government company liable for regulating and growing info know-how in Nigeria.
The alert comes as Microsoft confirms the vulnerability, tracked as CVE-2026-21509, is actively being exploited.
In accordance with NITDA, the zero-day vulnerability permits attackers to bypass Object Linking and Embedding (OLE) mitigations designed to guard customers from malicious code in Microsoft Workplace.
The flaw carries a CVSS rating of seven.8 and requires a sufferer to open a specifically crafted Workplace doc to be exploited
They famous that profitable exploitation may permit attackers to execute malicious code, compromise methods, ship malware, steal knowledge, or conduct lateral motion inside a corporation.
Final month, Microsoft publicly disclosed the excessive‑severity zero‑day flaw in its Workplace suite, after its personal safety groups detected energetic exploitation within the wild.
In accordance with studies, inside days of the emergency out‑of‑band replace being launched to repair the flaw, refined menace actors, together with Russia‑linked {groups} reminiscent of APT28 (often known as Fancy Bear), have been noticed weaponising the vulnerability to ship malware and conduct focused espionage operations throughout Europe and different areas.
Microsoft recognized the zero-day flaw affecting a number of Workplace merchandise, together with
Whereas Workplace 2021 and newer variations profit from service-side mitigations, customers should restart their purposes for the safety to take impact.
Additionally they urged Organizations to teach customers concerning the risks of opening unsolicited Workplace paperwork and implement endpoint safety and e mail filtering options to cut back publicity.
NITDA has actively guided Nigerian customers and organizations to reduce IT threat publicity.
The company additionally warned Nigerians about vulnerabilities in embedded SIM (eSIM) playing cards, playing cards utilized in smartphones, tablets, wearables and IoT gadgets.
