Nigeria’s National Information Technology Development Agency (NITDA) warned users about a security flaw in Microsoft Office in an advisory reported on February 19, 2026.
The warning concerned CVE-2026-21509, a vulnerability affecting security protections in Office documents. Contemporary accounts by Nairametrics and TechEconomy identified the alert as an agency communication.
Okay News reports that Microsoft separately documented a January 26 security update for Office 2016 addressing the same vulnerability. Its support page describes the issue as a Microsoft Word security-feature bypass.
TechEconomy linked the warning to NITDA’s Computer Emergency Readiness and Response Team. It reported that the agency urged organisations to apply relevant security updates and educate employees about unexpected Office attachments.
The February reports described the advisory as a response to exploitation identified at the time, rather than a confirmed attack on a named Nigerian organisation.
Microsoft’s documentation distinguishes between different Office installation types. It states that the update package applies to the Windows Installer-based edition of Office 2016 and does not apply to Click-to-Run editions.
Product-specific update requirements should be checked against Microsoft’s own documentation rather than assumed from an old advisory.
