Hackers exploit Cisco SD-WAN flaw to deploy custom KeyDrift malware

T1Critical 100Covered by 1 source · first reported by BleepingComputer at 29 Oct, 18:38 UTC

A newly identified advanced persistent threat (APT) group tracked as UAT-11473 was observed exploiting CVE-2026-20127, an authentication-bypass flaw in Cisco Catalyst SD-WAN Controllers, to deploy a custom malware framework called KeyDrift. [...]

devsecurity

Sources

• T1Hackers exploit Cisco SD-WAN flaw to deploy custom KeyDrift malwareBleepingComputer29 Oct, 18:38

Vulnerabilities

• CVE-2026-20127