UAT-11473 Exploits Cisco SD-WAN Authentication Bypass to Deploy KeyDrift

# UAT-11473 Exploits Cisco SD-WAN Authentication Bypass to Deploy KeyDrift

https://gcdradar.vercel.app/incidents/uat-11473-exploits-cisco-sd-wan-authentication-bypass-to-dep · AIR-2026-1626 · closed 2026-11-11

- Lane: Breaches & attacks
- Severity: 3 (Confirmed exploitation): Confirmed exploitation in real-world attacks.
- Fix status: No fix needed
- First reported: 2026-10-28
- AI role: No AI role
- Products: Cisco SD-WAN Catalyst Controller
- CVE ids: CVE-2026-20127

## Summary

The APT group UAT-11473 exploited CVE-2026-20127, an authentication bypass vulnerability in Cisco SD-WAN Catalyst Controller instances, to gain unauthorized access and deploy the KeyDrift malware.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2026-10-28: Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN (https://blog.talosintelligence.com/uat-11473-keydrift)

## Sources

- 2026-10-28 Cisco Talos: Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN https://blog.talosintelligence.com/uat-11473-keydrift

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.