Swiss Federal IT Agency FOITT compromised about 200 accounts due to SharePoint flaws

Switzerland’s Federal Office for Information Technology and Communications (FOITT) disclosed that approximately 200 accounts were compromised on its on-premises SharePoint servers. Attackers are believed to have exploited vulnerabilities in Microsoft’s SharePoint software, which Microsoft had reported in mid-July.

The FOITT is the largest IT service provider within the Federal Administration, managing around 50,000 workstation systems and over 1,000 specialist applications, as first reported by Security Affairs.

The FOITT detected anomalies on July 28 and confirmed the compromise of about 200 user and technical accounts on July 31. The agency immediately reset affected passwords and blocked external internet access to SharePoint while beginning to install security updates. Investigations, supported by the National Cybersecurity Centre (NCSC) and Microsoft, have not yet found evidence of further data leakage, but analysis is ongoing. The attackers are suspected of exploiting vulnerabilities, including CVE-2026-50522, which has a high CVSS score and allows for remote code execution with low complexity. As a precaution, the FOITT is reinstalling the affected servers entirely. This incident highlights the growing security risk associated with exposing SharePoint servers directly to the internet, especially given their deep integration with Microsoft authentication, making them a prime target for cybercriminals and nation-state actors seeking entry points into wider networks.

Source: Security Affairs