Covered by 2 outlets — first reported by Cisco Talos, Oct 28, 21:32 UTC
Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN
MentionsCisco
Summary
Cisco Talos says an advanced attacker it tracks as UAT-11473 exploited CVE-2026-20127, an authentication bypass flaw in Cisco Catalyst SD-WAN controllers, to gain unauthorized access and deploy a custom malware framework called KeyDrift. BleepingComputer also describes the group as newly identified. Talos characterizes the activity as historical, and CISA's catalogue of exploited flaws has listed the vulnerability since February.
AI summary by the SecurityTabs newsroom, checked against Cisco Talos, BleepingComputer. Read the outlets below for the full story.
Continue reading
2 outlets, in the order they reported it.
Cisco TalosFirst report
Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN
Talos has identified UAT-11473, a highly sophisticated APT, who exploited CVE-2026-20127, an authentication bypass vulnerability in Cisco SD-WAN Catalyst Controller instances to bypass authentication and gain unauthorized access to…
BleepingComputer
Hackers exploit Cisco SD-WAN flaw to deploy custom KeyDrift malware
A newly identified advanced persistent threat (APT) group tracked as UAT-11473 was observed exploiting CVE-2026-20127, an authentication-bypass flaw in Cisco Catalyst SD-WAN Controllers, to deploy a custom malware framework called KeyDrift.
Explained
The technology and terms in this story. Learn more
- ConceptAPT · Advanced persistent threatA well-resourced hacking group, usually tied to a government, that runs long, targeted campaigns.
- WeaknessAuthentication bypassA flaw that lets someone in without valid credentials.
- ConceptExploitCode or a technique that turns a software flaw into something an attacker can actually use.
- ConceptCVE · Common Vulnerabilities and ExposuresThe public ID system for vulnerabilities, such as CVE-2026-12345, so everyone means the same bug.
Why it was possible
The weaknesses behind this story's CVEs, from each CVE Record.