UAT-11473 Used Cisco SD-WAN Bug to Bypass Auth, Deploy KeyDrift

En bref

• UAT-11473, an APT group, targeted Cisco SD-WAN and Catalyst Controller.
• The entry point was CVE-2026-20127, an authentication bypass.
• After access, the intruders deployed KeyDrift malware.
• The number of affected organizations and full scope were not disclosed.
• The activity is historical, but exposure checks and patching still matter.

An APT group tracked as UAT-11473 is linked to exploitation of a Cisco vulnerability affecting SD-WAN and Catalyst Controller environments. The flaw, CVE-2026-20127, allows authentication to be circumvented, giving an intruder a path into systems that should require credentials. The activity is characterized as historical rather than a newly observed surge, and the number of affected organizations has not been made public.

Once past the login control, the attackers obtained unauthorized entry and placed KeyDrift malware on targeted systems. That sequence—exploit the CVE, evade the authentication check, establish access, then deploy a payload—shows how a single control-plane weakness can become an intrusion foothold. The public facts do not specify how many networks were touched or which victims were involved.

The relevance for K-12 and government IT teams is the same as for any edge or controller infrastructure: these devices often sit at trust boundaries and are managed by small teams. Cisco SD-WAN and Catalyst Controller systems should be treated as high-value assets even when the reported severity is medium, because an authentication bypass can expose management paths and lead to follow-on malware. Historical timing does not mean the risk is gone; unpatched or misconfigured devices can remain reachable.

What to watch: vendor guidance for CVE-2026-20127, signs of unexpected authentication success, unusual controller or SD-WAN configuration changes, and KeyDrift-related indicators. Confirm whether the environment uses affected versions, review logs around management access, and prioritize remediation based on exposure. Because the scale is unspecified, assume that any internet-facing or weakly segmented deployment could have been a candidate and validate rather than wait for victim counts.

À faire maintenant

1. Inventory all Cisco SD-WAN and Catalyst Controller instances, including internet-facing and management-plane endpoints; record versions and patch status.
2. Apply Cisco's fixed release or documented mitigation for CVE-2026-20127 immediately, prioritizing any device reachable from untrusted networks.
3. Restrict controller and SD-WAN management access to approved admin networks, enforce MFA, and remove unnecessary public exposure.
4. Review authentication and configuration logs for anomalous successful logins, new admin accounts, policy changes, or unexpected restarts; preserve evidence.
5. Hunt for KeyDrift malware indicators and unusual outbound traffic from controllers; isolate and rebuild confirmed compromised systems.
6. Rotate credentials and secrets that could have been exposed through controller access, including API tokens and local admin accounts.
7. If compromise is suspected, engage incident response, notify leadership, and follow state and education sector reporting requirements.

Références CVE

• CVE-2026-20127

Source originale

Cisco Talos