Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN

Talos has identified UAT-11473, a highly sophisticated APT, who exploited CVE-2026-20127, an authentication bypass vulnerability in Cisco SD-WAN Catalyst Controller instances to bypass authentication and gain unauthorized access to affected systems to deploy KeyDrift.

Source: Cisco Talos