Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN
// AI summary
Cisco Talos identified threat group UAT-11473, which exploited authentication bypass CVE-2026-20127 in Cisco SD-WAN Catalyst Controller instances to gain unauthorised access and deploy the KeyDrift malware.
// from the source
Talos has identified UAT-11473, a highly sophisticated APT, who exploited CVE-2026-20127, an authentication bypass vulnerability in Cisco SD-WAN Catalyst Controller instances to bypass authentication and gain unauthorized access to affected systems to deploy KeyDrift.