Threat intel
Cisco Talos Details UAT-11473 APT Exploiting Cisco SD-WAN Authentication Bypass to Deploy KeyDrift
Cisco Talos researchers say a highly sophisticated APT tracked as UAT-11473 exploited CVE-2026-20127, an authentication bypass vulnerability in Cisco SD-WAN Catalyst Controller instances, to gain unauthorized access and deploy the KeyDrift malware.
Cisco Talos has published research on a threat actor it tracks as UAT-11473, which it describes as a highly sophisticated advanced persistent threat (APT) group. According to the Talos blog, the actor exploited an authentication bypass vulnerability, tracked as CVE-2026-20127, affecting Cisco SD-WAN Catalyst Controller instances.
By abusing the flaw, the attackers were able to bypass authentication controls and gain unauthorized access to affected systems. Talos says this access was then used to deploy a malicious implant that its researchers have named KeyDrift. The report focuses on historical activity by UAT-11473 observed on Cisco SD-WAN infrastructure, analyzing how the group operated against these systems over time.
SD-WAN controllers play a central role in managing enterprise wide-area networks, so unauthorized access to them can be particularly sensitive, potentially exposing network configurations and the traffic of connected sites. Talos's write-up is intended to help defenders understand the tactics used against this type of environment. The item's description did not include specific victim information, exact timelines, or the number of organizations affected.
Organizations running Cisco SD-WAN Catalyst Controller instances should review the Talos findings and assess their exposure to the vulnerability cited in the report. All details in this article come from the Cisco Talos Blog.
Source: Cisco Talos Blog
