Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN
2026-10-29T08:51:43Z•d6815bb187b7f115f6dfab346489a22400b2a2f999570d1c553807653d97c09c
CVE-2026-20127APTCatalyst ControllerCisco SD-WANKeyDriftUAT-11473authentication bypassconfirmed exploitationinitial accessmalware deploymentnetwork infrastructure
What happened
Cisco Talos reports that the sophisticated APT UAT-11473 exploited CVE-2026-20127, an authentication-bypass vulnerability in Cisco SD-WAN Catalyst Controller instances, to obtain unauthorized access and deploy the KeyDrift malware. The activity represents confirmed exploitation of a critical network-management vulnerability by an advanced threat actor.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- cisco_talos
- Record identifier
- d6815bb187b7f115f6dfab346489a22400b2a2f999570d1c553807653d97c09c
- Enrichment time
- 2026-10-29T08:51:43Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.