Cisco SD-WAN flaw used to deploy KeyDrift malware Cisco Talos claims that UAT-11473 exploited CVE-2026-20127, a maximum severity authentication bypass bug in Catalyst SD-WAN controllers patched in February 2026, to deploy the custom KeyDrift framework. Targets observed included space and satellite services, defense and space technologies, and policy research organizations. KeyDrifts' reported function is not generic persistence alone: ​​it works within SD-WAN processes at the control plane, intercepts decrypted traffic, extracts session metadata and estimated IPsec key material, and then stages or extracts it. This places the compromise at the network control layer, with direct implications for reliable routing, peer integrity, and long-term access. Open sources - closed narratives.

Cisco SD-WAN flaw used to deploy KeyDrift malware Cisco Talos claims that UAT-11473 exploited CVE-2026-20127, a maximum severity authentication bypass bug in Catalyst SD-WAN controllers patched in February 2026, to deploy the custom KeyDrift framework. Targets observed included space and satellite services, defense and space technologies, and policy research organizations. KeyDrifts' reported function is not generic persistence alone: ​​it works within SD-WAN processes at the control plane, intercepts decrypted traffic, extracts session metadata and estimated IPsec key material, and then stages or extracts it. This places the compromise at the network control layer, with direct implications for reliable routing, peer integrity, and long-term access. Open sources - closed narratives.