GoKawiilSwitzerland’s federal IT office says hackers exploited vulnerabilities to breach its Microsoft SharePoint servers and compromised approximately 200 accounts.
The Federal Office for Information Technology and Telecommunication (BIT) detected the cyberattack after security specialists noticed unusual activity on its SharePoint servers on July 28.
After confirming the breach, BIT blocked external internet access to SharePoint, patched the suspected vulnerabilities, and reset the passwords for the affected accounts.
"During the analysis, security specialists discovered on Friday, July 31, that the login credentials for several accounts had been compromised," BIT said.
The agency believes the attackers exploited SharePoint vulnerabilities disclosed by Microsoft in mid-July and fixed in the July Patch Tuesday updates. However, it has not disclosed which flaw was used.
The attack potentially involved either CVE-2026-56164, an actively exploited SharePoint privilege escalation vulnerability, or CVE-2026-50522, a critical remote code execution flaw later exploited to steal SharePoint machine keys and maintain access after servers were patched.
Both of these flaws were fixed as part of the July 2026 Patch Tuesday updates.
It remains unclear whether either vulnerability was used in the Swiss government attack or whether the attackers exploited another flaw fixed in the same updates.
BIT is investigating the incident with assistance from the Swiss Federal Office for Cyber Security and Microsoft.
So far, it has found no evidence that data was stolen beyond the compromised login credentials.
... continue reading