According to Bleeping Computer, a newly identified advanced persistent threat (APT) group tracked as UAT-11473 was observed exploiting CVE-2026-20127, an authentication‑bypass flaw in Cisco Catalyst SD‑WAN Controllers, to deploy a custom malware framework named KeyDrift. The article notes that the group used the vulnerability to gain access and subsequently install the malicious component on affected systems.
The flaw resides in the authentication mechanism of the Cisco Catalyst SD‑WAN Controller. Exploitation by UAT-11473 enabled the deployment of KeyDrift, described as a custom malware framework developed by the actors. No further technical details about KeyDrift’s functionality are provided in the source.
Organizations running the vulnerable version of Cisco Catalyst SD‑WAN Controllers should apply vendor guidance or patches if available to mitigate exposure to the authentication‑bypass issue. Monitoring for unexpected connections or processes related to unfamiliar payloads is recommended as a precautionary measure.
