Hackers exploit Cisco SD-WAN flaw to deploy custom KeyDrift malware

A newly identified advanced persistent threat group tracked as UAT-11473 has been observed actively exploiting CVE-2026-20127, an authentication-bypass vulnerability in Cisco Catalyst SD-WAN Controllers. The attackers leverage this flaw to deploy a custom malware framework named KeyDrift. The exploitation targets network infrastructure at the controller level, potentially enabling broad access to SD-WAN environments. The threat actor appears to be sophisticated, consistent with APT-level capabilities. The use of a custom malware framework suggests significant resources and intent behind the campaign. Organizations using Cisco Catalyst SD-WAN Controllers are at risk and should apply patches or mitigations immediately. The incident underscores the ongoing threat to network infrastructure from state-level or well-resourced threat actors.