Baku:A security vulnerability has been identified in Microsoft Outlook by the National Cybersecurity Agency (NCA), leading to potential exploitation risks for users.

According to Azeri-Press news agency, the vulnerability is associated with Outlook's insufficient warnings about potentially dangerous operations. Attackers can exploit this flaw by sending specially crafted Office files, which, when opened, cause Outlook to connect to an external network controlled by the attacker, potentially exposing the user's NTLMv2 authentication credentials. Microsoft has acknowledged the real-world exploitation of this vulnerability.

The vulnerability has been assessed with a severity score of 6.5, classified as Medium, on the CVSS 3.1 scale. Additionally, a global outage affecting Microsoft 365 services has been reported since the previous evening, impacting users' access to Outlook, Teams, OneDrive, and Copilot, as well as causing disruptions in email delivery and online meetings.

In response, the National Cybersecurity Agency has issued guidelines urging users to be wary of suspicious emails and links, avoid sharing passwords or verification codes, rely on official Microsoft resources for service updates, and refrain from clicking on unknown links or downloading suspicious files.