Swiss Government SharePoint Hack: 200 Accounts Compromised via Critical Vulnerabilities

When Switzerland’s Federal Office for Information Technology and Communications (BIT), the agency that runs the government’s core IT infrastructure, gets compromised you know the vulnerability is serious. In early August, BIT disclosed that attackers had stolen credentials for roughly 200 accounts on its on-premises SharePoint servers, both regular user accounts and technical service accounts. One of the more significant cybersecurity incidents to hit the Swiss federal administration in recent years, and it illustrates a problem that goes well beyond Bern: the window between a vulnerability being patched and being exploited has shrunk to days, sometimes hours.

What happened

On July 28, BIT’s security team noticed unusual activity on the agency’s SharePoint environment. By July 31 forensic analysis confirmed the scope: login credentials for roughly 200 accounts had been stolen. BIT went public on August 4.

The agency immediately blocked all external internet access to the affected systems, applied security patches, and reset every compromised password. As a precaution they are rebuilding the compromised servers from scratch rather than just patching them, and external access stays blocked until that work is done.

One saving grace: BIT’s policy prohibits storing confidential information or particularly sensitive personal data on these SharePoint servers, so there is no evidence of document exfiltration beyond the stolen credentials themselves. That policy likely prevented this from being much worse.

July’s SharePoint vulnerability wave

The BIT breach did not happen in isolation. July 2026 saw an unprecedented wave of SharePoint exploitation with four separate vulnerabilities actively exploited within weeks of Microsoft’s July 14 Patch Tuesday release. Two of them, CVE-2026-56164 and CVE-2026-58644, were zero-days already under attack before patches existed, while the other two were weaponised within days of public proof-of-concept code appearing.

BIT has not confirmed which specific vulnerability was used against its systems, but the timing (unusual activity detected on July 28, just two weeks after patches dropped) points firmly at this wave.

CVE-2026-56164: no credentials required

This one is alarming in its simplicity. A missing authentication check in SharePoint’s Microsoft.Office.Server.UserProfiles assembly at the endpoint /_vti_bin/client.svc. An unauthenticated attacker can reach it remotely and escalate privileges with no credentials needed, no user interaction, just network access to the server.

Here is the part that should make security teams nervous: Microsoft rated this CVSS 5.3 (moderate) while the National Vulnerability Database independently scored it 9.8 (critical). That gap matters enormously because organisations that prioritise patches by Microsoft’s own severity ratings may have treated this as low-priority while attackers were already using it in the wild. It was discovered not through routine research but by Mandiant incident responders during an active investigation, meaning someone was already exploiting it before anyone knew it existed.

CVE-2026-50522: remote code execution via deserialization

This is the truly dangerous one, CVSS 9.8 with remote code execution and no authentication required. The mechanism: an attacker crafts a malicious .NET BinaryFormatter payload, wraps it as the cookie of a forged SecurityContextToken inside a WS-Federation sign-in response, and posts it to SharePoint’s /_trust/default.aspx endpoint. When the server deserialises the token the attacker’s code runs.

A working proof-of-concept in PowerShell appeared around July 20-21, and security firm watchTowr reported active exploitation against on-premises SharePoint instances almost immediately after.

Why patching alone is not enough

This is the detail that makes CVE-2026-50522 different from a typical patch-and-forget vulnerability. Attackers are using the RCE to extract IIS machine keys, the cryptographic secrets that SharePoint uses to sign authentication tokens. With those keys an attacker can forge valid session tokens, impersonate any user on the system, and access everything that identity has access to.

And here is what catches most organisations off guard: stolen machine keys remain valid even after patching. You can apply every update Microsoft has ever released, but if the keys were stolen before you patched the attackers can still forge authentication tokens indefinitely unless you also rotate those keys. It is like changing the lock but not realising the burglar already made a copy of the master key.

WatchTowr put it bluntly: patching is not enough, defenders must rotate credentials on any asset that may have been exposed.

BIT’s response

BIT’s response was thorough and (importantly) went beyond just applying patches. They blocked external access, reset all affected credentials, and are fully rebuilding the compromised servers from scratch. They coordinated with Switzerland’s National Cybersecurity Centre (NCSC) and Microsoft, and shared technical indicators with operators of Swiss critical infrastructure.

The decision to rebuild rather than simply patch deserves recognition because it is the only way to truly ensure no persistence mechanism survives. Many organisations would have stopped at patching, and BIT did the right thing.

Lessons for every organisation

Patch speed matters more than ever. The window between patch release on July 14 and confirmed exploitation was roughly one to two weeks, and for zero-days like CVE-2026-56164 there was no window at all since exploitation preceded the fix. Treating Patch Tuesday as a monthly routine rather than an urgent response is borrowed time.

Patching is necessary but not sufficient. When attackers steal machine keys or cryptographic secrets they maintain access even after vulnerabilities are fixed. Key rotation, credential resets, and server rebuilds must be part of incident response rather than afterthoughts.

Severity ratings can mislead. Microsoft rated CVE-2026-56164 as moderate while the NVD rated it critical. Organisations relying solely on vendor assessments may deprioritise actively exploited zero-days, which is a genuinely dangerous position to be in.

Data classification provides real protection. BIT’s policy of not storing confidential data on these SharePoint systems limited the damage, and that is not just a compliance checkbox but a concrete risk reduction measure that worked exactly when it needed to.

We assess on-premises infrastructure security including SharePoint, Exchange, and Active Directory through penetration testing and security architecture reviews. If you want to know whether your systems are hardened against current threats: get in touch.

Sources:

Autor: Andriu Isenring CISSP