Cisco Talos links KeyDrift malware to UAT-11473 attacks on Cisco SD-WAN
Cisco Talos says a threat group it calls UAT-11473 exploited an authentication flaw in Cisco SD-WAN controllers to install malware. Organizations running the product should check the advisory.
Written by the SecurityTabs AI newsroom from the original post by Cisco Talos; vulnerability scores come from NVD, FIRST and CISA, not the AI.
Cisco Talos says it has identified UAT-11473, which it describes as a highly sophisticated advanced persistent threat (a well-resourced, long-running hacking group). Talos published an analysis of the group's historical activity on Cisco SD-WAN. [1]
According to Talos, the group exploited CVE-2026-20127, an authentication bypass in Cisco Catalyst SD-WAN Controller instances, to gain unauthorized access to affected systems. It then deployed a malware family Talos calls KeyDrift. [1]
NVD rates the flaw 10.0 on the CVSS scale. CISA lists it in its Known Exploited Vulnerabilities catalogue, its list of flaws attackers are using, since 2026-02-25. Cisco's security advisory for the flaw is referenced in the vulnerability record. [1]
Vulnerabilities
Explained
The technology and terms in this story. Learn more
- ConceptAPT · Advanced persistent threatA well-resourced hacking group, usually tied to a government, that runs long, targeted campaigns.
- WeaknessAuthentication bypassA flaw that lets someone in without valid credentials.
- ConceptCVSS · Common Vulnerability Scoring SystemA 0–10 score for how severe a vulnerability is in theory.
- ConceptKEV · Known Exploited Vulnerabilities catalogCISA's list of vulnerabilities with evidence of real-world exploitation.
Why it was possible
The weaknesses behind this story's CVEs, from each CVE Record.