Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN
Cisco Talos uncovered APT group UAT-11473 exploiting an SD-WAN Catalyst Controller auth bypass (CVE-2026-20127) to deploy the KeyDrift implant — a direct threat to enterprises using Cisco's SD-WAN fabric.
Summary written by editorial AI · Source link below
Talos has identified UAT-11473, a highly sophisticated APT, who exploited CVE-2026-20127, an authentication bypass vulnerability in Cisco SD-WAN Catalyst Controller instances to bypass authentication and gain unauthorized access to affected systems to deploy KeyDrift.
Editorial Analysis
SD-WAN controllers sit at the trust boundary of enterprise branch and cloud connectivity; an APT-grade authentication bypass with an active implant framework makes this one of the most consequential network-infrastructure threats this quarter.
Immediately patch CVE-2026-20127 on all Cisco SD-WAN controllers and conduct a retrospective compromise assessment using Talos-published IOCs.
A state-level hacking group has compromised Cisco SD-WAN infrastructure — the technology underpinning many enterprises' branch and cloud networking — requiring urgent patching and investigation.
Forward-looking interpretation drafted by editorial AI under human review — not a reproduction of the source. See methodology.
External link — opens at Cisco Talos in a new tab.
More from the Threat Intel Desk
- Hackers pull off $133 million French bank heist via service provider2d
- Fake security tools on GitHub push backdoors and infostealers3d
- The Good, the Bad and the Ugly in Cybersecurity - Week 45 (2026)3d
- CEO-spoofing scammers used AI to help steal more than $100 million, feds say3d
- Chainalysis says breach exposed credentials for all customers3d