News AnalysisStanding

Swiss SharePoint incident tied to two high-percentile CVEs

Updated 14 August 2026 · Timeframe: Current snapshot

The headline asserts a 200-account compromise in the Swiss government’s Microsoft SharePoint breach. CVE-2026-45659 sits in the 95th EPSS percentile, entered KEV on 2026-07-01, and matches 143 confirmed app-vuln-management cases plus 19 confirmed exploit-campaign stories. CVE-2026-55040 reaches only the 86th percentile with no KEV entry and a later July 2026 publish date, giving it weaker exploitation telemetry so far.

Why it matters

The data separate the self-hosted attack surface from the hosted majority that faces no direct exposure.

What to do

• Security leaders. Flag self-hosted SharePoint instances for immediate patching; treat hosted tenants as lower priority unless logs show anomalous access.
• Lean IT orgs. Check inventory for on-premise SharePoint servers first, then schedule the KEV-listed CVE ahead of the second one.
• MSPs. Run a quick tenant scan to confirm which clients still run their own SharePoint farms and route those patches this week.

Our take

Our own data behind a live news story, generated on tap — the depth the headline skips.