Loading story…
Switzerland’s federal IT agency disclosed that attackers compromised about 200 accounts on on-premises SharePoint servers operated by the Federal Office for Information Technology and Communications (BIT), also referred to in reporting as FOITT. The intrusion was detected after anomalies were identified roughly a week earlier, and officials said both user and technical accounts were affected. Initial analysis found no evidence that data beyond login credentials was accessed, and the attackers had not been publicly identified.
Swiss authorities said the breach likely involved exploitation of SharePoint vulnerabilities patched by Microsoft in its July Patch Tuesday updates. In response, the agency blocked internet access to the affected SharePoint systems for users outside the federal administration, applied patches, and began reinstalling impacted servers. The incident adds to wider concern over active exploitation of SharePoint flaws, including the risk that abused IIS machine keys could let attackers retain persistence unless the keys are rotated and IIS is restarted.
See which actors are running it and whether you're in range.
7 events from the most recent confirmed update back to the earliest known activity.
On August 5, 2026, the Canton of Graubünden said it detected a cyberattack against a SharePoint server hosting the cantonal administration’s website after a warning about similar attacks on Swiss federal SharePoint systems. Initial analysis found no evidence of data exfiltration or compromised accounts, and the canton scheduled emergency patching while temporarily taking the website offline.
On July 31, 2026, analysis determined that credentials for about 200 user and technical accounts had been compromised in the SharePoint incident. The affected passwords were then reset, while authorities said they had found no evidence of data leakage beyond the credentials.
FOITT said Switzerland’s National Cybersecurity Centre and Microsoft are supporting the investigation into the SharePoint compromise. The agency also shared relevant technical indicators from the incident with Swiss critical infrastructure operators through the national cybersecurity platform.
BIT/FOITT disclosed that attackers had compromised roughly 200 accounts on its on-premises SharePoint servers. Its initial analysis found no evidence that data beyond login credentials had been accessed, and the attackers had not been identified.
After detecting the intrusion, BIT patched the SharePoint vulnerabilities it believed were exploited and started reinstalling the affected servers as a precaution. The agency suspected exploitation of vulnerabilities addressed in Microsoft’s July Patch Tuesday updates.
On the same day the anomalous access was detected, BIT blocked internet access to the affected SharePoint systems, including access for users outside the federal administration. This was part of its immediate containment response.
Switzerland’s Federal Office for Information Technology and Communications (BIT/FOITT) said security specialists detected anomalies on its on-premises Microsoft SharePoint servers. The agency later linked the activity to a compromise affecting about 200 user and technical accounts.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
11 references tracked. Mallory keeps watching after this page renders.
itpro.com
Open sourcecyberveille.ch
Open sourcecybersecuritynews.com
Open sourcehelpnetsecurity.com
Open sourcemalware.news
Open sourcetherecord.media
Open sourceadmin.ch
Open sourcecyberveille.ch
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Government cyber authorities in Colombia and Panama warned about a critical Microsoft SharePoint Server vulnerability affecting on-premises deployments, with Panama identifying the flaw as **`CVE-2026-50522`**. The bug is an unauthenticated remote code execution issue tied to **CWE-502 insecure deserialization** in SharePoint Server 2016, 2019, and Subscription Edition, reportedly reachable through the **`/_trust/default.aspx`** WS-Federation endpoint using crafted tokens. The alerts emphasize that **SharePoint Online is not affected**, while Internet-exposed on-premises servers face the highest risk. Microsoft released patches, but public reporting cited subsequent proof-of-concept activity followed by broad exploitation of exposed servers, prompting **CISA** to add **`CVE-2026-50522`** to its Known Exploited Vulnerabilities catalog. CSIRT Panamá warned that attackers could steal **IIS machine keys**, forge authentication tokens, and maintain access even after patching unless affected organizations also rotate keys and restart IIS or SharePoint services. Defenders were urged to patch immediately, assume exposed servers may already be compromised, reduce Internet exposure, and review logs and webshell indicators for signs of intrusion.
Aug 5, 2026
CISA and Microsoft warned that multiple **on-premises SharePoint Server** vulnerabilities are being actively exploited against internet-facing systems, with attackers using a chain involving `CVE-2026-32201`, `CVE-2026-45659`, and `CVE-2026-56164` to gain unauthorized access, execute code, steal IIS and ASP.NET machine keys, maintain persistence, and deploy malware. The agencies said the activity affects supported on-premises SharePoint deployments rather than SharePoint Online, and follows earlier Microsoft reporting that Chinese threat actors including **Linen Typhoon**, **Violet Typhoon**, and **Storm-2603** had abused similar SharePoint flaws to install web shells, dump credentials, move laterally, and in some cases deploy **Warlock ransomware**. Microsoft’s July 2026 updates also fixed two additional critical SharePoint bugs, `CVE-2026-55040` and `CVE-2026-58644`, which were not yet confirmed as exploited but were assessed as likely targets for rapid weaponization, while separate reporting said another SharePoint exploit chain may remain unpatched pending a later release. Defenders were urged to immediately apply available patches, enable **AMSI** in Full Mode, reduce or remove internet exposure, restrict access to SharePoint Central Administration, review logs and endpoint telemetry for compromise, and only rotate IIS or ASP.NET machine keys after confirming whether intrusion activity is already present.
Aug 27, 2026
More than **1,370 internet-facing Microsoft SharePoint servers** were reported exposed to active exploitation of **`CVE-2026-32201`**, a spoofing vulnerability affecting SharePoint Server 2016, 2019, and Subscription Edition. Microsoft disclosed the flaw in April and CISA added it to the **Known Exploited Vulnerabilities** catalog the same day, underscoring the urgency for defenders. Although Microsoft scored the bug at **CVSS 6.5**, the risk is elevated because it can be exploited **remotely without authentication** against exposed on-premises deployments, potentially allowing attackers to impersonate users, access or alter sensitive content, steal credentials, and move laterally inside victim environments. The exposure comes amid broader concern over SharePoint security, including Microsoft's disclosure of **`CVE-2026-26106`**, a **remote code execution** vulnerability in SharePoint Server, and earlier reporting that a **China-linked threat actor** was involved in SharePoint attacks, according to Mandiant. The concentration of exposed systems was highest in the **United States**, and the combined reporting points to sustained attacker interest in SharePoint as a route into enterprise networks. Organizations were urged to apply Microsoft's available updates, reduce direct internet exposure of SharePoint servers, and closely monitor authentication and document-access activity for signs of compromise.
Jun 29, 2026