🤖 CVE-2026-20127: unauthenticated auth bypass in Cisco Catalyst SD-WAN Controller/Manager/Validator (flawed peering auth). Crafted requests grant a high-privileged internal account with NETCONF access to the fabric. APT UAT-11473 exploits it to deploy the KeyDrift malware framework.
🔗 https://www.bleepingcomputer.com/news/security/hackers-exploit-cisco-sd-wan-flaw-to-deploy-custom-keydrift-malware/
#CVE #CyberSec #Cisco #SDWAN
BleepingComputerHackers exploit Cisco SD-WAN flaw to deploy custom KeyDrift malwareA newly identified advanced persistent threat (APT) group tracked as UAT-11473 was observed exploiting CVE-2026-20127, an authentication-bypass flaw in Cisco Catalyst SD-WAN Controllers, to deploy a custom malware framework called KeyDrift.