AD FS zero-day CVE-2026-56155: Microsoft DART finds DKM ACL bug already exploited
Microsoft's DART discovered CVE-2026-56155 during a live intrusion. CISA added it to KEV on July 14. Patch KB 5121391 audits DKM ACLs today, auto-remediates October 13.