BIT/FOITT SharePoint Server breach (Switzerland, 2026-07)

UPDATE — attackers are running Rapid7's SharePoint proof-of-concept against honeypots within a day, and the published root cause is four validation failures that let an unsigned token impersonate a site administrator

UPDATE · originally covered UPDATE — the half-patched SharePoint chain this pipeline flagged in July is now complete and public: CVE-2026-63520 ships, and Rapid7 releases the analysis and proof-of-concept for CVE-2026-55040 (2026-08-12)

yesterday's entry recorded that Rapid7 had published a technical analysis and proof-of-concept for CVE-2026-55040 and stated plainly that it did not have that analysis in hand, so no behavioural detail could be offered. Two things changed within a day. The proof-of-concept is being used in attacks, and the analysis — read in full for this entry — turns an exposure problem into a hunt.

Threat-intelligence company Defused reported on 2026-08-12 that "Attackers are now using the @rapid7 POC for CVE-2026-55040 against our SharePoint honeypots", roughly a day after the code was published (BleepingComputer, 2026-08-12). That is one company observing its own sensors, not a vendor confirmation: the same report notes that "While Microsoft has labeled this security flaw as an attractive target for attackers", it has not yet flagged it as successfully exploited in the wild (BleepingComputer, 2026-08-12). Switzerland's NCSC added the exploitation-attempt claim to its own July Patch Tuesday advisory on 12 August, having added the analysis and proof-of-concept to the same advisory the day before (NCSC-CH, 2026-08-12). For scale, the same reporting cites Shadowserver, which "currently tracks over 8,500 Microsoft SharePoint servers exposed online", with the honest caveat that how many are honeypots or already patched is unknown (BleepingComputer, 2026-08-12).

How the bypass works, and why it matters that it is four bugs and not one. Rapid7's analysis, based on decompilation of the identity module from a fully patched Subscription Edition build, states that "The root cause is a chain of four distinct weaknesses that, when combined, allow an unauthenticated remote attacker to forge a valid JWT and impersonate any SharePoint site user" (Rapid7, 2026-08-11). SharePoint's server-to-server authentication uses a nested token: an outer token carrying user identity claims, and an inner "actor token" representing the calling application that is expected to be cryptographically signed. Each of the four failures removes one guarantee from that design.

First, the token handler explicitly turns off the requirement for signed tokens when it builds its validation parameters — Rapid7's description is blunt: "This single line disables the JWT library's cryptographic signature verification", so the outer token is accepted with no signature at all. Second, the code resolves the inner actor token's signing key from a thumbprint value carried in that token's own header, searching all trusted certificates including SharePoint's own local security-token-service certificate, and assigns the resolved key without ever verifying a signature against it. Third, issuer validation then looks for a registered token service matching that certificate, does not find one — because the server's own signing certificate is not in the collection being searched — and treats the absence of a match as grounds to accept rather than reject. Fourth, the final signature step requires only that a signature string be non-empty; any arbitrary value satisfies it. The result is that the identity in the outer token's name claim, which the caller chooses, is resolved to a real account. (Rapid7, 2026-08-11)

Two properties of that chain matter operationally more than the mechanics themselves. The certificate whose thumbprint the attacker needs is published by the server: Rapid7 records that it is retrievable from an unauthenticated metadata endpoint on the SharePoint site itself, so no prior access is required to obtain it. And picking a useful identity is a separate reconnaissance step — Rapid7 describes querying the target's domain controller over an anonymous SMB session to learn the domain identifier, then walking relative identifiers to enumerate candidate accounts and find one that is a site administrator, noting that a user principal name works too but is less reliable to guess. (Rapid7, 2026-08-11)

Detection, in telemetry terms. The decisive weakness leaves a server-side record: Rapid7's decompilation shows the issuer-validation path emitting a trace message stating that the issuer was accepted because no registered token service matches the signing certificate, immediately before returning success (Rapid7, 2026-08-11). On a healthy farm that path should be rare; on an attacked one it fires on every forged token. That message in the SharePoint diagnostic trace logs is the highest-value single artefact available, and it is a server-side one, so it survives an attacker who never touches the endpoint. Alongside it, three sequences are worth building around: an unauthenticated request to the site's metadata endpoint from an external address, followed within a short window by bearer-token requests to the site's REST API from the same source; authenticated REST activity — reading files, minting a form digest, changing configuration — with no corresponding interactive sign-in or federation token issuance for that account in identity logs; and anonymous SMB sessions enumerating account identifiers from an address that also talks to the SharePoint front end.

Triage: legitimate server-to-server integrations also present bearer tokens to the SharePoint REST API, which is why the token's presence is not the signal. The discriminators are the ones the mechanism forces: a token whose acceptance is accompanied by the unregistered-signing-certificate trace message, activity attributed to a highly privileged account with no matching sign-in event in the identity provider, and an external source address that fetched the unauthenticated metadata endpoint shortly beforehand. A normal integration is registered, so its issuer resolves against a registered token service and never takes the accepting-by-default branch.

European government's own operating infrastructure was the target this week — a federal document platform, a national beneficial-ownership register, a state treasury and a heat plant, with two of the entry points on no internet-facing asset inventory

If you did nothing this week: peer institutions in five European jurisdictions disclosed compromises of the machinery they run the state with — and in two of them the way in was connectivity and legacy infrastructure that appears on no internet-facing asset inventory.

Switzerland took two of them in 48 hours, at both levels of government. The Bundesamt für Informatik und Telekommunikation, which operates the Confederation's own data centres, disclosed on 4 August that its on-premises SharePoint Servers were compromised and that "rund 200 Konten kompromittiert wurden" — user accounts and technical service accounts alike (Der Bundesrat / BIT, 2026-08-04). The detail that matters for anyone still running on-premises SharePoint is the timing: BIT had begun installing the July updates immediately on release, and staff spotted the anomalies on 28 July while that work was in progress, so the servers are being rebuilt from scratch rather than patched in place. One day later the Canton of Graubünden's IT office reported a compromise of a SharePoint server hosting the cantonal administration's public web presence, reporting on first analysis no accounts compromised and no data exfiltrated (Kanton Graubünden, 2026-08-05); Keystone-SDA reporting adds that two files were placed on the server and their code was not executed (persoenlich.com, 2026-08-05). Neither Swiss disclosure names a CVE, which is why an estate-wide compromise assessment keyed on the July SharePoint exploitation window — not a CVE-scoped patch check — is the operation this pair calls for.

Two further disclosures show the objective shifting from the citizen's data to the state's own authoritative record. Liechtenstein's Amt für Justiz lost copies of the beneficial-ownership register: "Datenkopien von rund 31'000 Rechtsträgern widerrechtlich abgegriffen" (Regierung des Fürstentums Liechtenstein, 2026-08-02), and the government's follow-up media conference published the exact field set — legal-entity name plus surname, first name, date of birth, nationality and country of residence, with no address, telephone number or financial data recorded (Regierung des Fürstentums Liechtenstein, 2026-08-04). That composition is the point: what was taken is an identity-verification kit tied to the natural persons behind Swiss- and EU-administered structures, not a marketing list. In Hungary, Telex.hu reports that the Magyar Államkincstár's Agricultural and Rural Development Office was breached in late July by ByteToBreach — the actor already tracked here for the attack on Romania's national land registry — with experts consulted on attacker-leaked screenshots assessing entry through an Oracle WebLogic server whose fixes date to an October 2017 patch cycle, escalating to Windows domain-administrator rights (Telex.hu, 2026-08-03).

The week's most consequential access path was published on its last day. CERT Polska's follow-up forensic report on the 29 December 2025 attacks on Poland's energy sector discloses a second, previously unnamed victim — a combined heat and power plant supplying about 50,000 residents, where three Siemens PLCs were switched to STOP mode and password-locked, shutting down a steam turbine and the process-water treatment system. The attacker reached it from an already-compromised wind-farm substation by tunnelling over SSH through a cellular router into the distribution system operator's private APN, a mobile network shared by both sites, and then into a WAGO PFC200 controller whose WAN-side web interface answered on factory credentials (CERT Polska incident follow-up report, 2026-08-08). CERT Polska states that "the use of a private APN to gain access to the OT network was the first instance of this attack vector being observed in a real-world cyberattack," and — the sentence European operators should act on — that surveys of organisations using similar solutions "indicated that this configuration was commonly encountered in Poland" (CERT Polska, 2026-08-08). Belgium supplies the fifth shape: Digitaal Vlaanderen confirmed to WIRED that Belgium's Centre for Cybersecurity notified it on 3 March 2026 of a North Korean compromise, that the affected workstation was isolated and exposed credentials rotated, and that the incident is contained — one organisation inside a victim set the researcher built from nearly two years of access to the actors' own servers (WIRED, 2026-08-05).

Triage: a compromised administrative estate of this kind produces telemetry that reads as ordinary operations, so the discriminators are relational rather than atomic. For the SharePoint cases, look for web-application process trees spawning script interpreters and for service-account authentication from hosts those accounts never normally touch — a service account is defined by its narrow, repetitive access pattern, and the deviation is the signal. For the OT path, the discriminator is direction and origin: an inbound management session to a field controller arriving from a peer device inside the carrier APN rather than from the operator's own engineering workstation subnet, and a controller-mode change (run to STOP) with no corresponding change-management window. Legitimate remote maintenance produces the same protocol events; it does not normally originate from another site's equipment.

Builds on: 2026-08-05/bit-foitt-swiss-federal-sharepoint-breach-200-accounts · 2026-08-06/canton-graubuenden-sharepoint-server-breach · 2026-08-04/liechtenstein-vwbp-beneficial-ownership-register-breach · 2026-08-05/liechtenstein-vwbp-entry-point-identified-field-set · 2026-08-05/hungary-state-treasury-mvh-bytetobreach-weblogic · 2026-08-09/cert-polska-private-apn-pivot-into-ot-chp-plant-shutdown · 2026-08-08/dprk-contagious-interview-blast-radius-flemish-government

Canton Graubünden discloses a SharePoint server breach a day after the Confederation did — the on-premises wave has reached Swiss cantonal government

The Amt für Informatik (AFI) of Canton Graubünden detected a cyberattack against the SharePoint server that hosts the cantonal administration's public web presence (Kanton Graubünden, 2026-08-05). The canton's own account is that a first analysis found no indication that accounts were compromised or data exfiltrated, and that confidential information and specially-protected personal data are not stored on those web-presence servers in the first place; the cantonal ePortal and specialised applications were unaffected and remained reachable through the remediation (Kanton Graubünden, 2026-08-05). AFI head Lorenz Tanner, speaking to the Keystone-SDA news agency, put the intrusion on the afternoon of 29 July and said two files were placed on the server whose code was not executed — meaning the compromise sat unremarked for roughly a week before disclosure (persoenlich.com, 2026-08-05). AFI carried out an extraordinary update from the evening of 5 August (persoenlich.com, 2026-08-05), during which the canton said its website would be unreachable for several hours (Kanton Graubünden, 2026-08-05).

What makes this operationally significant for the constituency is not the canton's own limited damage but the pattern: this is the second confirmed Swiss public-sector victim of on-premises SharePoint exploitation disclosed in two days, after the Confederation's IT provider BIT reported roughly 200 compromised federal user and technical accounts (covered here on 2026-08-05). Tanner's stated view is that it could be the same vulnerability identified at federal level, one he describes as affecting SharePoint systems worldwide, and AFI is coordinating with the Federal Office for Cybersecurity (persoenlich.com, 2026-08-05). That link is a plausibility stated by the victim, not a confirmed technical finding — neither Swiss disclosure names a CVE, and no authority has published one for either incident, so an operator should treat "same flaw as the Confederation" as a working hypothesis rather than a scoping fact.

Triage: SharePoint farms legitimately write files into those directories during solution deployments, patch installation and content updates, so file creation alone is not the signal. The discriminators are timing and actor — writes that fall outside a change window, that are not attributable to an administrator session or a deployment job, and that are performed by the web-server worker process rather than the update or deployment tooling. A file that never executes, as at Graubünden, produces no process-execution event at all, so a detection strategy resting only on child-process spawning would have missed this one.