Infrastructure

Home page

Infrastructure

National Cybersecurity Agency: Security vulnerability detected in Microsoft Outlook

13 November 2026 16:09 (UTC +04:00)

A security vulnerability has been detected in Microsoft Outlook, the National Cybersecurity Agency (NCA) said, APA-Economics reports.

"The vulnerability is related to the product's failure to properly warn users about potentially dangerous operations. An attacker exploiting the vulnerability can send a specially crafted Office file to a user and, when the file is opened, cause Outlook to connect to an external network address controlled by the attacker. As a result, the user's NTLMv2 authentication credentials may be exposed to the attacker. Microsoft has confirmed that the vulnerability has been exploited in real-world attacks."

The vulnerability has been rated 6.5 – Medium – on the CVSS 3.1 severity scale.

It should be noted that, according to the agency, a global outage of Microsoft 365 services has been recorded since yesterday evening. Users have experienced difficulties accessing Outlook, Teams, OneDrive and Copilot, delivering emails and organizing online meetings.

In this regard, the National Cybersecurity Agency (NCA) has advised users to follow these security guidelines:

- Be cautious of suspicious emails and links sent in Microsoft's name requesting updates or verification of account information;

- Do not share your passwords or verification codes with third parties;

- Obtain information about the status of services only from Microsoft's official resources;

- Do not click on unknown links presented as solutions to the problem or download suspicious files.

Ilaha Salimova

Azerbaijan National Cybersecurity Agency Microsoft Outlook Microsoft 365 cybersecurity security vulnerability NTLMv2 cyberattacks data security global outage Microsoft Teams OneDrive Copilot CVSS 3.1