Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN
Talos has identified UAT-11473, a highly sophisticated APT, who exploited CVE-2026-20127, an authentication bypass vulnerability in Cisco SD-WAN Catalyst Controller instances to bypass authentication and gain unauthorized access to affected systems to deploy KeyDrift.
Excerpt from the primary source: Cisco Talos Intelligence
Who is affected
Enterprises · Security professionals
Affected technology: Catalyst SD-WAN Controller and Manager, Cisco networking & security
Why it matters
CISA lists this as exploited in the wild. Unpatched Cisco networking & security and Catalyst SD-WAN Controller and Manager systems are exposed to active attacks now.
Automated: stated only from CISA listings and the exploitation evidence in the sources below.
What you should do · Act now
Treat this as an emergency. Identify every system running Cisco networking & security and Catalyst SD-WAN Controller and Manager, apply the vendor's fix or published mitigations immediately, and check for signs of compromise. Patching alone does not remove an attacker who already got in.
CISA's required action for CVE-2026-20127: "Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available." US federal civilian agencies must comply by February 27, 2026.
Automated guidance based on this story's classification. Check the linked advisories for specifics.
Sources
We link to original and authoritative sources. Headlines and excerpts belong to their publishers.
Related
Cisco Patches 34 Vulnerabilities Across Multiple Products
Critical-severity security defects could lead to command execution, authentication bypass, and XSS attacks.
Apply the vendor's security update for Cisco networking & security.
Compromised eMudhra intermediate certificates
Cisco Talos is aware of eight intermediate certificates belonging to the intermediate certificate authority, eMudhra.
Two critical RCEs in PHP core
Cisco Talos is tracking the disclosure of two unauthenticated remote code execution (RCE) flaws in PHP core, dubbed “php2shell”, triggered by a plain HTTP request and exploitable before any application code runs, affecting every PHP build since 5.4. Based on the entities involved in the disclosure, artificial…
Parasitizing trust: How legitimate infrastructure becomes a delivery pipeline for attackers
Adversaries are turning the tools businesses trust into delivery mechanisms for malicious activity. Cisco Talos observed abuse of more than 25 legitimate platforms over the past year, exploiting the built-in trust of collaboration, file-sharing, payment and other services to reach their targets.