Steal one key. Become anyone.

The most dangerous attack isn't the one that steals a password or hijacks a session. It's the one that forges the proof of identity itself — a validly signed token that says you're anyone the attacker wants to be, trusted by every application you own, with no password and no second factor. That attack is being used in the wild right now.

What's being exploited

On July 14, 2026 — inside Microsoft's largest-ever Patch Tuesday — sat CVE-2026-56155, an actively exploited elevation-of-privilege flaw in Active Directory Federation Services (AD FS). CISA added it to its Known Exploited Vulnerabilities catalog the same day, with a federal patch deadline of July 28. It was credited to Microsoft's own Detection and Response Team — the incident-response unit that typically finds bugs like this while investigating a breach already in progress. In other words, attackers were using it before anyone had a name for it.

Technically it's mundane: insufficiently granular access control on the AD FS Distributed Key Manager (DKM) container, letting a low-privileged local attacker escalate to administrator on the AD FS host — no user interaction, low complexity. The consequence is anything but mundane.

Why admin on AD FS is the whole kingdom

AD FS is the federation server — the machine that signs the SAML tokens your applications trust to prove who a user is. Log into Microsoft 365, a SaaS app, an internal tool via single sign-on, and behind the scenes AD FS issues a cryptographically signed token that says "this is who they are." Every connected service trusts that signature without question. That's the entire point of federation.

The DKM holds the keys used to sign those tokens. So an attacker who reaches administrator on the AD FS host gets the keys — and with the keys, they can forge their own valid token asserting they are any user, for any connected service. The CEO. A domain admin. Anyone. This is the attack the industry calls Golden SAML, and it is as close to omnipotent as identity attacks get: no password to crack, no MFA prompt to satisfy, no further authentication of any kind. Mint a token, present it, and the application welcomes you as whoever you claimed to be.

Stealing a credential gets you one account. Stealing the key that signs identity gets you all of them — including the ones that don't exist yet. You don't break into the building. You become the person who issues the badges.

The reason nothing catches it

A forged SAML token is nearly invisible to the tools built to catch intrusions, because there is no intrusion to catch. There's no exploit at the app, no failed login, no malware, no anomaly in the authentication itself — the token is cryptographically valid, and the sign-in succeeds. As far as every downstream service is concerned, the real user just logged in and got to work. The attacker isn't evading your detection. They're wearing a perfectly legitimate identity your own infrastructure minted for them.

The evidence still exists — it's just behavioral, not technical, and it's buried. The "user" authenticates from a device or geography that doesn't match how they actually work. An account accesses systems it has never touched, in a sequence that makes no sense for that person's role. A token appears that skipped the normal sign-in flow entirely. Each of those is a faint signal in a sea of millions of real, benign logins — and no human SOC watching an SSO estate can pick the forged identity out of that noise by hand, fast enough to matter.

Catch the identity that's valid but isn't real

This is where making sense of the noise beats inspecting any single event. n0limit treats every authentication and identity action as something to investigate against what's actually true about that user — not something to wave through because the token's signature checked out. When an identity authenticates in a way that contradicts its own established pattern — new device, impossible location, a role reaching where it never reaches, a token that bypassed the normal flow — those signals are enriched, correlated across the estate, and resolved to a verdict in under 500 microseconds, with a reasoning trail an operator can audit.

The point is that a valid signature is no longer proof of a real user. When an attacker can forge your identities at will, "the login succeeded" and "it's really them" become two entirely different claims — and only one of them matters. A defense that trusts the signature has already lost; the one that asks is this really them? — and answers at machine speed, before the forged identity finishes its work — is the only thing standing between one stolen key and every account you have.