Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN

T1Critical 100Covered by 1 source · first reported by Cisco Talos at 28 Oct, 21:32 UTC

Talos has identified UAT-11473, a highly sophisticated APT, who exploited CVE-2026-20127, an authentication bypass vulnerability in Cisco SD-WAN Catalyst Controller instances to bypass authentication and gain unauthorized access to affected systems to deploy KeyDrift.

security

Sources

• T1Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WANCisco Talos28 Oct, 21:32

Vulnerabilities

• CVE-2026-20127