UAT-11473 Exploits Cisco SD-WAN Controller Flaw to Deploy KeyDrift

Key points

• UAT-11473 exploited CVE-2026-20127 against Cisco's Catalyst SD-WAN controller systems.
• The vulnerability permits authentication bypass, and the actor followed with KeyDrift malware.
• Severity is medium; exposure checks and log review should begin immediately.
• Controller compromise can affect network control and device management trust.

Threat researchers have tied a campaign against Cisco's Catalyst SD-WAN controller systems to an actor tracked as UAT-11473. The group exploited CVE-2026-20127, a vulnerability that allows authentication to be bypassed, and then placed custom malicious code called KeyDrift on targeted systems. The combination matters because controller infrastructure sits at the center of wide-area network policy and device management; unauthorized access there can undermine trust in the network control plane.

Organizations running Cisco's Catalyst SD-WAN controller appliances should treat this as an exposure issue rather than a theoretical one. The facts indicate both an access-control failure and post-exploitation malware activity, so defenders need to look for unauthorized entry as well as follow-on artifacts. The severity is currently medium, but that rating should not be read as permission to delay: controller compromise can have outsized operational impact even when the initial flaw is scored modestly.

The actor's use of a custom implant suggests the campaign is not opportunistic scanning alone. KeyDrift deployment implies a deliberate step after the authentication bypass. That sequence—exploit first, malware second—is the key detection opportunity. Teams should correlate controller authentication events with unexpected process, file, or network activity on related management hosts.

What to watch: vendor guidance for CVE-2026-20127, any signs of anomalous logins to controller interfaces, and indicators associated with UAT-11473 or KeyDrift. Because the facts do not specify affected versions or exploitation scale, avoid assuming your environment is clean without verification. Prioritize internet-facing and management-plane systems, validate logging coverage, and preserve evidence if suspicious access is found.

What to do now

1. Inventory all Catalyst SD-WAN controller instances from Cisco, starting with management interfaces reachable from untrusted networks.
2. Apply Cisco's fixed release or documented mitigation for CVE-2026-20127 as soon as possible; if patching is delayed, restrict management access.
3. Limit controller management planes to trusted networks and require strong MFA where supported.
4. Review authentication logs for unexpected successes, new admin activity, or log gaps around controller interfaces.
5. Hunt for KeyDrift artifacts and UAT-11473 indicators on controllers and adjacent management hosts; preserve evidence before cleanup.
6. If bypass is suspected, rotate controller credentials, API tokens, and keys, then validate configuration integrity.
7. Enable heightened monitoring and retain logs for incident review; confirm backups are isolated and restoration is tested.

CVE references

• CVE-2026-20127

Original source

BleepingComputer