FAA Ground Stop, Microsoft 365 and Workday Outages: What’s Documented and What Isn’t

CommandEleven Intelligence Desk // Critical Infrastructure Desk, status as of November 14, 2026.

Bottom Line Up Front

Three technology failures hit US operations inside roughly 30 hours: Microsoft 365 on Thursday, November 12; the FAA nationwide ground stop on Friday, November 13; and a Workday outage that began Friday evening and was still unresolved on Saturday. Officials explain the FAA stop as old communications equipment overwhelmed by an upgrade. Workday says a disaster-recovery test connected the wrong systems to production databases. Microsoft has published no cause in the sources we reviewed. [REPORTED]

Nothing public links the three events to each other or to a hostile actor. The Homeland Security Secretary said the FAA stop was not linked to the Microsoft outage and did not appear to be a cyberattack, but when asked for certainty he said “nothing is certain right now.” [REPORTED] This assessment sets out what is documented, what each official account would need to show, and where outside actors could fit if the official account fails. It does not claim an attack.

Key Judgments

• [REPORTED] The FAA account is consistent across CNN and The New York Times: overloaded legacy network equipment, inconsistent router readings, instability in radar communications. It is the leading explanation.
• [DATA DEFICIT] No root-cause report exists yet for any of the three events. Microsoft’s post-incident report, Workday’s own audit and any FAA or inspector-general review are the documents that settle this.
• [ASSESSED, moderate confidence] The strongest pattern is not a shared attacker but shared fragility: concentrated platforms and aging systems where one change or one fault spreads widely. That pattern also makes these systems attractive targets, which is why the outside-actor question belongs in the assessment even without evidence.
• [ASSESSED, low confidence] Workday’s wording (“tenanted services … unexpectedly connected to Production databases”) does not exclude an intrusion, and it does not point to one. Only Workday’s audit can distinguish a test error from misuse of legitimate access.

The Fragility Was Already on the Record

The Government Accountability Office flagged the fragility of the air traffic system before this week. Its report, GAO-26-107992, is also the source for the wording that the January 2023 stop was the first nationwide ground stop since September 11, 2001. [CONFIRMED]

Facility-level failures have piled up in the 18 months before November 13. The Newark technology failure of April 2025 is the one officials keep citing; The New York Times noted Friday that Secretary Duffy used it to argue for a $12.5 billion upgrade and is now using this stop to argue for more. Our research file also lists failures at Dallas (September 2025), Minneapolis (August 2026) and Philadelphia (September 21, 2026), each reported by news outlets; we have not re-verified their details for this flash assessment. [REPORTED] A week before the stop, the FAA announced it would replace floppy disks still used at more than 400 facilities by the end of 2028, per Reuters as cited by CNN.

Why: the official account

Decades-old equipment, patched and upgraded piecemeal, fails in unexpected ways, and the fix needs money. Duffy told reporters the old systems “will continue to fail” without more funding. [REPORTED]

Why: where outside actors could fit

Every modernization step adds new connections to systems that were once isolated. An aviation safety expert told CNN that replacing copper with digital links creates vulnerabilities that did not exist before. That is a risk statement, not evidence of intrusion. [REPORTED]

Microsoft 365 and the Recent Outage Ledger

Microsoft logged an Exchange Online incident beginning at 16:17 UTC on November 12. Downdetector reports reached about 19,650 per minute at 18:25 UTC and about 11,000 at 19:38 UTC, across 74 countries and territories, according to figures reported by BusinessToday. Early reports from the UK, India and New Zealand each rose about tenfold within 12 minutes, from 17:43 to 17:55 UTC. Downdetector counts user reports, not affected users. [REPORTED] GoDaddy notified its own customers of degraded Microsoft email service, which is how many small businesses first learned of it; we saw that notice only through a third-party tracker (OutageDeck). [REPORTED]

Other large cloud failures since September

A third-party tracker (Control Plane, last updated November 10) lists four major provider incidents since September, each with a stated operational cause and none attributed to an attack. [REPORTED]

Read together with November 12, the pattern is large platforms failing from changes and maintenance faults, which is also the pattern an adversary would try to imitate or exploit. The data cannot separate the two.

Why: the official account

Microsoft has not stated a cause in the material we reviewed, so there is no official narrative to test yet. Its own post-incident report is the document to watch. The DHS Secretary said the FAA stop was unrelated to this outage. [REPORTED]

Why: where outside actors could fit

A near-simultaneous onset across many regions fits a global configuration or network change. It would also fit a deliberate action against shared infrastructure. Public data does not distinguish them, and we make no attribution. [DATA DEFICIT]

What Happened to the FAA Across the US

At 3:54 pm ET on Friday, November 13, the FAA ordered all departures stopped. More than 3,500 aircraft were in the air when it began (CNN, ABC News). Duffy said airspace reopened at about 8:15 pm ET, a little over four hours later. The Washington Post reported that planes still airborne fell from 3,115 after one hour to 1,150 after three. [CONFIRMED]

Impact figures differ by source and are still moving. Cirium, cited by The New York Times, counted more than 8,200 US flights canceled Friday, over 31 percent of the schedule. FlightAware, cited by CNN, counted more than 15,000 flights delayed or canceled Friday, with about 3,000 more expected Saturday. European airlines also canceled or delayed US-bound flights on Saturday. [REPORTED]

The FAA’s stated root cause

Duffy said “incredibly old” air traffic control routers became overloaded with data and began giving inconsistent readings, causing instability in radar communications. He said the fix pointed to a legacy network problem, that it was not linked to the FAA’s new AI-powered system, and that controllers could still reach pilots because the outage was intermittent. Homeland Security Secretary Markwayne Mullin said new technology added to an existing framework overwhelmed the older system. [REPORTED] Duffy also said he did not anticipate an outage like this.

One dissent is on the record, with limits. A Washington Examiner reporter told CNN that none of about 60 controllers she spoke to accepted the explanation, because upgrades of that kind are normally done overnight in midweek, not on a Friday afternoon. That is one reporter relaying unnamed sources. [REPORTED, single source]

Three numbers that circulated online

Why: the official account

An upgrade stressed an aging network, and the stop was a safety response. The account also carries a funding argument: Duffy asked Congress for emergency money. The New York Times noted his official ask is $30 billion, while he and Mullin spoke of $50 billion on Friday. An explanation that supports a budget request is not false for that reason, but it is also not independent. [REPORTED]

Why: where outside actors could fit

Asked whether they could rule out a cyberattack or “rogue artificial intelligence” with 100 percent certainty, Mullin said nothing was certain and that it did not appear that way. The timing, a busy Friday afternoon, is the anomaly controllers cite. An upgrade-induced overload and a hostile disruption can look alike from outside; only logs and an independent review can separate them. [DATA DEFICIT]

What SMART Is and How the FAA Uses It

SMART stands for Strategic Management of Airspace, Routes and Trajectories. The FAA describes it as a platform that combines about 200 data streams, including weather, flight paths, traffic flow and controller staffing, and uses an AI-supported engine to forecast congestion and recommend actions to FAA staff, who can accept or decline them. It does not control aircraft or replace controllers. The FAA unveiled it on September 21, 2026, began limited use that day around Washington, D.C., and plans a staged rollout from the National Capital Region. [CONFIRMED, FAA release]

Why: the official account

Duffy said the ground stop was not linked to SMART and affected only legacy equipment (CNN). On that account, SMART is irrelevant to November 13. [REPORTED]

Why: where outside actors could fit

A system that ingests about 200 feeds is a large integration surface, and any integration of new software with old networks is where the official account says the FAA stop began. We have no evidence that SMART played a role, and the FAA says it did not. The question to put to the investigation is whether any new data pipeline sat on the stressed legacy network. [DATA DEFICIT]

Workday

Reports of Workday failures spiked on Friday evening US time; Downdetector logged nearly 3,000 reports shortly after 22:00 GMT, and Emerson College said its system went offline around 22:15 GMT, per UC Today. Workday said it placed all WD1 production tenants into maintenance and would post updates about every 30 minutes. As of 06:35 GMT Saturday it had announced no restoration. Workday serves more than 11,500 organizations and says only that “some” customers are affected. Viral claims that Walmart and Target were hit are unconfirmed. [REPORTED]

We did not draw a map of affected US regions. The graphics circulating online for the Microsoft and Workday events were not backed by evidence, and no public source lists affected customers or locations. Organizations may also decline to say they were affected. If your organization runs on the platform, assume exposure until Workday’s audit says otherwise. [DATA DEFICIT]

Why: the official account

Workday attributed the problem to a disaster-recovery test. Its status notice, as relayed by Washington University IT and UC Today, said “tenanted services within the DR Site unexpectedly connected to Production databases,” leaving data in an inconsistent state that can cause tenant access errors and failed jobs, integrations and tasks. We could not locate the original notice wording beyond those relays, so it stays at [REPORTED]. University of Nevada, Reno posted WD1 production notices on June 5 (certificate error) and August 24 (intermittent service interruption), so this is not the first disruption this year.

Why: where outside actors could fit

The phrase is unusual for a customer notice. In multi-tenant software, a tenant is one customer’s isolated environment, so “tenanted services” most plausibly means per-customer services running in the recovery site. That reading supports Workday’s test-error account. It does not exclude a second explanation: an intruder using valid credentials and built-in administrative tools (living off the land) can look like an operations mistake in the first hours. Nothing public supports that. Workday’s audit is the document that can distinguish the two. [ASSESSED, low confidence]

What Does It Mean for Your Business and Travel

Business

• Treat email, identity and HR or payroll platforms as single points of failure. Know your manual fallback for timekeeping, pay and approvals before you need it.
• Keep one out-of-band channel (phone tree, a second messaging service) that does not depend on Microsoft sign-in.
• Ask each critical vendor, in writing, for its post-incident report and the date it will arrive. Check what your contract says about notification and service credits.
• Run your own recovery tests with production isolated, and review any change window that falls on a peak business day.
• Do not wait for a vendor to confirm you were affected. If you are on the platform, check your own logs and data for inconsistencies.

Travel

• Officials said recovery would be slow and that Thanksgiving travel should not be affected, but they also warned that more such failures will occur until the system is upgraded. Build in margin.
• Per CNN, if an airline cancels your flight you are owed a refund if you choose not to travel; you can refuse a credit.
• An aviation expert quoted by CNN advised early-morning flights, which tend to be less delayed.
• If you hold US-bound flights from Europe this weekend, confirm with your airline; several were canceled or delayed Saturday.

What To Watch

• Microsoft’s post-incident report for November 12.
• Workday’s restoration notice and root-cause or audit statement.
• Any FAA, DOT or inspector-general review of the November 13 outage, and any independent release of logs.
• Congressional action on the $30 billion air traffic request.
• Further facility-level FAA outages, which officials themselves predict.
• Any official confirmation of elevated force protection levels at UK bases. Our September 28 Fairford dossier reported Fairford at FPCON Delta on September 26, inferred from observation and not officially confirmed, and Lakenheath at Charlie. We found no source placing UK bases at Delta now. [DATA DEFICIT]

Dated Calls

Calls We Will Score. We will score each on the date shown and record the result on the Foresight Record.

1. By November 30, 2026: Microsoft publishes a post-incident report that attributes the November 12 outage to an internal change or fault, not an external attack.
2. By December 15, 2026: Workday publishes a root-cause statement that does not attribute its outage to external intrusion.
3. By December 31, 2026: No US official attributes the FAA ground stop to a cyberattack or foreign actor.
4. By December 31, 2026: At least one further FAA facility outage triggers a ground stop at a major US airport.

What This Assessment Does and Doesn’t Establish

• Does: the FAA ground stop ran about four hours and 20 minutes; officials attribute it to overloaded legacy equipment after an upgrade; it was the second nationwide stop since 9/11; Workday attributes its outage to a disaster-recovery test.
• Does: the three events happened within about 30 hours, and no public source ties them to one another.
• Does not: establish any cause beyond what officials and companies have stated, or show that any of the three involved a hostile actor.
• Does not: resolve the “22 centers” figure, or confirm final totals for flights affected.
• Does not: confirm which Workday customers were affected, or the current force protection level at any UK base.
• Limits of our reading: we read CNN and the New York Times live coverage directly; the Washington Post pages would not open for us, so we relied on its search snippets. Several other US outlets block automated reading.

Frequently Asked Questions

Was the FAA ground stop a cyberattack?

Officials say it does not appear to be, and attribute it to overloaded legacy equipment. The Homeland Security Secretary also said nothing is certain. No public evidence of an attack exists.

Were the Microsoft, FAA and Workday outages connected?

No public source connects them. The DHS Secretary said the FAA stop was not linked to the Microsoft outage.

How many flights were affected by the FAA ground stop?

Figures are still firming. Cirium counted more than 8,200 US flights canceled Friday; FlightAware counted more than 15,000 delayed or canceled.

What is SMART?

The FAA’s Strategic Management of Airspace, Routes and Trajectories platform, an AI-supported planning tool unveiled September 21, 2026. Officials say it was not involved in the ground stop.

Related CommandEleven Intelligence Reading

• Black October and PHP2Shell
• US counter-drone policy and the interagency MOU
• RAF Fairford: U.S. charges and the HAYI network
• Iran dead hand and mosaic defense
• Iran underground missile city

Sources

• CNN live updates, November 13 to 14, 2026
• The New York Times live updates, November 13 to 14, 2026
• The New York Times, What to Know About Friday’s Nationwide Ground Stop (paywalled after the opening)
• The Washington Post, FAA lifts ground stop at U.S. airports (search snippet only; page not opened)
• GAO-26-107992
• FAA, SMART announcement
• ABC News, nationwide ground stop
• PBS NewsHour/AP, air traffic control and the aging system
• BusinessToday, Microsoft 365 disruption
• TechRadar, Outlook outage live
• OutageDeck, GoDaddy notice (third-party tracker)
• Control Plane, cloud outage tracker (third-party)
• UC Today, Workday outage
• Engadget, Workday outage
• University of Nevada, Reno, Workday notice, August 24
• University of Nevada, Reno, Workday notice, June 5
• The War Zone, security levels at US bases in England
• CommandEleven, RAF Fairford dossier, Part 1