CVE-2026-20127

CVSS

—

EPSS

0.893 (99.8th percentile)

CISA KEV

Added 2026-02-25, due 2026-02-27

Exploitation

No report

Public exploits

9 repositories

State

Unknown

Coverage

• 

  ● Actively exploitedCritical 100Cisco Talos◆Authoritative. Authoritative publisher: a primary source, or a newsroom with formal editorial standards1 hour ago

  Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN

  Talos has identified UAT-11473, a highly sophisticated APT, who exploited CVE-2026-20127, an authentication bypass vulnerability in Cisco SD-WAN Catalyst Controller instances to bypass authentication and gain unauthorized access to affected systems to deploy KeyDrift.

  ↗blog.talosintelligence.com/uat-11473-keydrift(opens the publisher's site in a new tab)

What we observed

1. 24 Sept, 12:34poc publishedpoc-in-github
2. 24 Sept, 12:17poc publishedpoc-in-github
3. 24 Sept, 11:54poc publishedpoc-in-github
4. 24 Sept, 11:50kev addedcisa-kev