Hackers exploit Cisco SD-WAN flaw to deploy custom KeyDrift malware
Summary
An APT group, identified as UAT-11473, is actively exploiting CVE-2026-20127, an authentication bypass vulnerability in Cisco Catalyst SD-WAN Controllers. This exploitation allows the group to deploy a custom malware framework known as KeyDrift.
IFF Assessment
The exploitation of a Cisco SD-WAN vulnerability by an APT group to deploy custom malware represents a significant threat to organizations relying on this technology.
Severity
CISA KEV: Listed as actively exploited. Federal patch due: February 27, 2026. Known ransomware use: Unknown.
Defender Context
This incident highlights the importance of patching and securing network infrastructure, particularly critical components like SD-WAN controllers. Defenders should be vigilant for signs of compromise on Cisco SD-WAN devices and monitor for the deployment of the KeyDrift malware.