Between 28 July and 31 July 2026, attackers exploited CVE-2026-56164 — a SharePoint Server elevation-of-privilege vulnerability that was already listed on the CISA Known Exploited Vulnerabilities catalog — and compromised approximately 200 user and technical accounts on the SharePoint platform operated by the Federal Office for Information Technology, Systems and Telecommunication (FOITT), also known as BIT. External access to the affected environment was blocked within hours of detection, all credentials reset across the tenant, and the impacted servers placed into a full rebuild process under forensic oversight by the National Cyber Security Centre (NCSC) and Microsoft. No sensitive classified data has been confirmed as exfiltrated at the time of writing, but the investigation is ongoing.
The incident is significant not only because it targets the Swiss federal IT backbone, but because it is the first confirmed ISA-reportable breach inside the federal IT estate since Switzerland's Information Security Act entered its enforcement phase. Every Swiss critical-infrastructure operator, federal contractor, and cantonal IT provider has been watching for exactly this kind of live test. The FOITT case supplies the raw material for answers to questions that until now remained theoretical: when does the 24-hour reporting clock start, who owns notification when a shared platform is the victim, and what forensic obligations fall on an organisation that reinstates systems before the investigation is closed?
CVE-2026-56164: What the Vulnerability Does and Why It Matters at Scale
CVE-2026-56164 is an elevation-of-privilege flaw in on-premises SharePoint Server. An authenticated attacker who has obtained any valid user credential — through phishing, credential stuffing, or a prior compromise — can leverage the vulnerability to gain SharePoint farm administrator-level access without further interaction from the victim. CISA added it to KEV following confirmed exploitation in the wild; by the time of the FOITT incident, the vulnerability had been known for several weeks and a patch was available. The gap between patch availability and exploitation at FOITT illustrates the structural problem that affects not just government entities but any large on-premises SharePoint deployment: patch testing, change-management cycles, and legacy customisations routinely delay remediation by weeks even when the patching team is aware of the severity.
SharePoint's position in Swiss organisations makes this vulnerability particularly dangerous. For federal agencies, FOITT's SharePoint platform is not merely a document repository; it carries interdepartmental workflows, procurement documentation, personnel records, and integration touchpoints with internal line-of-business applications. A farm-level compromise means that an attacker who escalates via CVE-2026-56164 can read all site collections, modify permissions, inject content, exfiltrate documents at scale, and — critically — maintain persistent access through farm-level service accounts that may not appear in routine identity reviews. Detecting such an account against a background of thousands of legitimate technical identities requires instrumented logging that many Swiss on-premises SharePoint installations do not have in place.
The ISA Reporting Clock in Practice
Switzerland's Information Security Act requires operators of federal IT systems to report significant incidents to the NCSC within 24 hours of detection. The FOITT case is the first time this obligation has been tested at the federal level under live conditions, and several aspects of the timeline deserve careful attention by security teams across the public and private sectors.
The attack window ran from 28 to 31 July — a period of four days before external access was blocked. The public disclosure came on 7 August, a week after containment. This gap is not inherently irregular: ISA reporting obligations are owed to the NCSC, not the public, and investigation confidentiality has legitimate operational justification. What is relevant is the internal timeline: at what point was the compromise detected, what triggered that detection, and whether the 24-hour clock to the NCSC was respected from that moment. FOITT has confirmed NCSC involvement in the forensics, which implies the regulator was notified appropriately. But for private-sector operators — banks, insurance groups, healthcare systems, and energy utilities subject to ISA through their own critical-infrastructure designations — the FOITT timeline offers a calibration point: four days from initial access to containment is not unusual for a credential-based lateral-movement attack, and any incident-response plan that assumes a sub-24-hour discovery window is almost certainly optimistic.
A further complication arises from shared platforms. FOITT does not operate SharePoint purely for its own departmental use; the platform underpins services consumed by other federal offices. When a shared infrastructure provider is the victim, multiple operators may have indirect exposure through the same event. ISA's notification framework does not provide explicit guidance on how cascading notifications are coordinated when the breached entity and the affected entities are organisationally distinct. The FOITT case makes this a live policy question rather than a hypothetical one.
◆ Key Takeaway
The FOITT SharePoint breach demonstrates that even a well-resourced federal IT operator can face a multi-day window between initial access and containment when an actively exploited vulnerability hits a complex on-premises platform. For Swiss critical-infrastructure operators, the incident sets a concrete reference point: patch velocity for KEV-listed vulnerabilities must be measured in days, not change-management cycles; detection instrumentation on SharePoint and equivalent platforms needs to surface farm-level account changes; and ISA's 24-hour reporting clock starts at detection, not at containment — which means your NCSC notification process must be ready to run before you have a full picture.
What the Rebuild Decision Tells Us About Swiss Incident Recovery
FOITT confirmed that the affected servers are being fully reinstalled rather than patched in place. This is operationally correct and forensically defensible: when farm-level credentials are compromised, an in-place remediation that removes known malicious artifacts but leaves a complex SharePoint topology intact cannot guarantee that all persistence mechanisms have been identified. A clean rebuild from validated images eliminates the uncertainty. But the decision carries costs that are worth naming explicitly, because they appear on the balance sheet of every organisation that must make the same call.
Full rebuilds take time and resource that an organisation must absorb while operating degraded. For FOITT, which serves federal departments whose workflows depend on the platform, a sustained rebuild cycle creates operational pressure that may push users toward workarounds — shadow SharePoint sites, email-attached documents, or consumer cloud storage — that create new data-governance risks. Swiss organisations facing ISA operational-continuity obligations should treat FOITT's rebuild as a live test of Business Continuity Management capability and document what happened to the workflows that depended on the platform during the outage period. The ISA framework's resilience requirements are not satisfied by a successful technical rebuild alone; the continuity of the services those systems support is the actual obligation.
Implications for Swiss Operators Running On-Premises SharePoint
Switzerland has a high density of on-premises SharePoint deployments relative to its EU neighbours, driven by data-residency requirements in the financial sector, healthcare, and the public sector, as well as Infomaniak and Swiss cloud hosting norms that differ from the hyperscaler-first defaults common in larger markets. This means the FOITT vulnerability class has a larger blast radius in Switzerland than aggregate global patch data would suggest. If your organisation operates SharePoint Server on-premises, the following assessment is immediate:
- Verify that CVE-2026-56164 and any companion SharePoint CVEs from the July Patch Tuesday cycle have been applied; if they have not, treat this as a priority-one remediation regardless of your standard change-management cadence.
- Audit farm administrator and service accounts created or modified in the past 90 days; in a post-exploitation scenario, attacker-created technical accounts are the most common persistence vector that survives a credential reset sweep.
- Enable Unified Audit Logging on the SharePoint farm if it is not already active, and forward logs to your SIEM with alerts on permission changes at the farm and site-collection level — these are the signals that would have surfaced the FOITT lateral movement earlier.
- Confirm your ISA (or FINMA/DORA, where applicable) incident-notification runbook explicitly states that the 24-hour clock begins at credible detection, not at confirmed impact or executive sign-off; the FOITT timeline makes this a test question your regulators will ask.
- If you operate SharePoint as a shared service for other business units or subsidiaries, map the notification chain: which entity reports to NCSC, how does the notification cover downstream tenants, and is there a documented escalation path that does not depend on the platform itself being operational?
- Review business continuity procedures for the SharePoint-dependent workflows in your organisation; a rebuild scenario that takes two to four weeks should have a named degraded-mode procedure for each critical workflow, not just a disaster-recovery RTO target.
The FOITT incident will, in the months ahead, generate NCSC guidance and likely revisions to federal IT security requirements. Swiss private-sector operators should track that output, but they should not wait for it. The attack vector — a known, actively exploited, patched vulnerability in a widely deployed on-premises platform — is not novel. What is novel is having a confirmed ISA-reportable incident in a Swiss federal institution to calibrate against. The organisations that use this case to sharpen their own detection, patching, and notification processes now will be better placed when the next KEV-listed platform vulnerability arrives — and the historical frequency of SharePoint CVEs gives no reason to expect that will be a long wait.