CVE-2026-20127

Hackers exploit Cisco SD-WAN flaw to deploy custom KeyDrift malware

A newly identified advanced persistent threat group tracked as UAT-11473 was observed exploiting CVE-2026-20127, an authentication-bypass flaw in Cisco Catalyst SD-WAN Controllers, to deploy a custom malware framework called KeyDrift. Active exploitation has been confirmed, with attackers leveraging the vulnerability to gain unauthenticated remote access and execute arbitrary code on affected controllers. Cisco has released security updates addressing the vulnerability, and administrators are urged to apply the latest firmware updates to mitigate the risk.