Cisco SD-WAN auth bypass exploited to deploy KeyDrift
A newly identified advanced persistent threat (APT) group tracked as UAT-11473 was observed exploiting CVE-2026-20127, an authentication-bypass flaw in Cisco Catalyst SD-WAN Controllers, to deploy a c
What Happened
Cisco Catalyst SD-WAN Controllers are being targeted in the wild through CVE-2026-20127, an authentication-bypass vulnerability that allows unauthenticated attackers to gain a foothold on the controller plane. A newly tracked advanced persistent threat group, designated UAT-11473, is exploiting the flaw to deploy a previously unseen malware family dubbed KeyDrift.
The campaign is distinct from commodity scanning. Intelligence indicates UAT-11473 moves deliberately: it bypasses authentication, establishes persistence, then stages KeyDrift for follow-on activity. Cisco SD-WAN Controllers sit at the center of enterprise network orchestration, which makes them a high-value staging ground rather than an incidental target.
This is the latest in a run of Cisco exploitation activity, following the Cisco Catalyst SD-WAN Manager auth bypass (CVE-2026-76504), which had public proof-of-concept code circulating.
Why It Matters
SD-WAN Controllers distribute policy, keys, and configuration to every branch and data center edge in a distributed network. Compromise of the controller is not a single-host event; it is a trust-plane event. An attacker who controls the orchestrator can push routing changes, redirect traffic, or stage malware across the entire fabric.
The involvement of a named APT (UAT-11473) and custom tooling (KeyDrift) elevates this from a patching chore to an active intrusion campaign. Organizations that treat SD-WAN infrastructure as “network plumbing” rather than a crown-jewel asset are the most exposed.
Technical Details
- Vulnerability: CVE-2026-20127, an authentication bypass in Cisco Catalyst SD-WAN Controller. The severity is rated critical.
- Exploitation pattern: UAT-11473 bypasses authentication on the controller, then deploys KeyDrift, a bespoke payload consistent with a state-aligned or well-resourced actor.
- Affected systems: Cisco Catalyst SD-WAN Controller deployments (and, by extension, the managed edge devices that trust them).
- Indicators: Defenders should hunt for anomalous authentication events on controllers, unexpected configuration pushes, and outbound connections from controller nodes to infrastructure not managed by the org.
Cisco’s broader product family is under sustained pressure. Recent examples include the Cisco ASA VPN DoS (CVE-2026-76418) and the Cisco Secure Email Gateway unauth root RCE (CVE-2026-76519), the latter with public PoC code.
Immediate Risk
Risk is CRITICAL for any organization running unpatched Cisco Catalyst SD-WAN Controllers, particularly those with internet-exposed management interfaces. APT activity implies appetite for long-term access, not smash-and-grab. Treat every controller reachable from untrusted networks as potentially compromised until verified. Confirm patch status immediately; apply Cisco’s fixed release; and audit controller logs for the exploitation pattern described above. Because KeyDrift is custom malware, signature-based detection may be thin, so behavioral monitoring on controller nodes is the higher-yield control.
Security Insight
The controller plane is the new domain controller. For two decades defenders have ring-fenced identity systems (Active Directory, SSO) because compromising them means compromising everything downstream. SD-WAN Controllers now occupy the same trust position: they issue keys, push policy, and authenticate every edge device. The exploitation of CVE-2026-20127 against this tier should trigger a re-categorization of SD-WAN controllers as identity-adjacent infrastructure, deserving the same segmentation, logging, and privileged-access controls as a domain controller. Most SD-WAN controller deployments today are still treated as run-of-the-mill network gear. That assumption is precisely what UAT-11473 is exploiting.
Further Reading
Never miss a security update
Get real-time security alerts delivered to your preferred platform.
Related News
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a critical authentication bypass flaw impacting Cisco Catalyst SD-WAN Manager to its Known Exploited Vulnerabilities
Cisco has released security updates to address a maximum-severity Identity Services Engine vulnerability that attackers are actively exploiting in the wild. [...]
Cisco warned customers to patch a critical Secure Email Gateway zero-day security flaw that threat actors have been exploiting in attacks. [...]
Cisco Talos says two recently patched Secure Firewall Management Center (FMC) vulnerabilities have been exploited by three separate threat clusters linked to ransomware and state-sponsored attacks. [.