CERT24Hackers exploit Cisco SD-WAN flaw to deploy custom KeyDrift malwareLoading data…
CERT24Threat Observatory
Period

Hackers exploit Cisco SD-WAN flaw to deploy custom KeyDrift malware

A newly identified advanced persistent threat tracked as UAT-11473 exploited the authentication-bypass vulnerability CVE-2026-20127 in Cisco Catalyst SD-WAN Controllers to deploy the custom KeyDrift malware framework. Cisco patched the flaw in February 2026. The observed attacks targeted space and satellite services, defense and aerospace technology, and policy research organizations.

← Back to intelligence

Hackers exploit Cisco SD-WAN flaw to deploy custom KeyDrift malware

A newly identified advanced persistent threat tracked as UAT-11473 exploited the authentication-bypass vulnerability CVE-2026-20127 in Cisco Catalyst SD-WAN Controllers to deploy the custom KeyDrift malware framework. Cisco patched the flaw in February 2026. The observed attacks targeted space and satellite services, defense and aerospace technology, and policy research organizations.