NewsCisco Talos
Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN
Teaser from the source
Talos has identified UAT-11473, a highly sophisticated APT, who exploited CVE-2026-20127, an authentication bypass vulnerability in Cisco SD-WAN Catalyst Controller instances to bypass authentication and gain unauthorized access to affected systems to deploy KeyDrift.
This is the RSS-feed teaser. Read the full article at the original source.
Read at Cisco TalosLinked advisories
- CVE-2026-20127Security Advisory 2026-002 — Multiple Vulnerabilities in Cisco Products
- CVE-2026-20127KeyDrift malware steals SD-WAN encryption keys from Cisco Catalyst SD-WAN controllers hacked through CVE-2026-20127
- CVE-2026-20127Exploitation of Cisco SD-WAN appliances
- CVE-2026-20127Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability
- CVE-2026-20127Active Exploitation of Critical Vulnerability in Cisco Catalyst SD-WAN
- CVE-2026-20127Cisco Catalyst SD-WAN Controller and Manager — Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability
- CVE-2026-20127cisco catalyst_sd-wan_manager: unzureichende Authentifizierung
- CVE-2026-20127Cisco Catalyst SD-WAN Controller and Manager: Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability
Affected vendors and products
More on KeyDrift
Other advisories
Source: https://blog.talosintelligence.com/uat-11473-keydrift/
ID