The Swiss Federal Office of Information Technology, Systems and Telecommunication (BIT) has confirmed a breach affecting user and technical accounts, with attackers exploiting Microsoft SharePoint vulnerabilities to gain access. The breach has been linked to CVE-2026-56164, an actively exploited SharePoint privilege escalation flaw, and CVE-2026-50522, a critical remote code execution vulnerability. The department has notified the Federal Office for Cybersecurity and the State Secretariat for Security Policy. Attribution has not been established.

Widely deployed collaboration platforms like SharePoint have become prime attack surfaces precisely because they underpin day-to-day operations across departments — a single compromised account can serve as a pathway to reconnaissance, privilege escalation, and lateral movement into more sensitive systems. Moreover, the window between vulnerability disclosure and exploitation continues to shrink. Even organizations that patch quickly can find that attackers have already established persistence — CVE-2026-50522 was reportedly exploited to steal SharePoint machine keys, allowing continued access after patching. That combination of exposed collaboration infrastructure and rapid post-disclosure exploitation makes reactive patching insufficient on its own.

Public sector cybersecurity now depends on treating identity, collaboration platforms, and connected infrastructure as a single defensive surface rather than isolated systems. Continuous monitoring of authentication behavior, privilege changes, and lateral movement across SharePoint and adjacent services is essential to catching credential abuse before it escalates. Equally critical is retaining full-fidelity evidence — packets, flows, logs, and identity events — long enough to determine what an attacker did between initial access and detection, especially when persistence mechanisms like stolen machine keys may outlast the patch cycle. Platforms like NIKSUN provide that unified evidence base to detect and remediate anomalous activity. Read more about this story on our LinkedIn page