type: cve · created: 2026-10-30 · updated: 2026-10-30 · tags: [cve] · confidence: medium · severity: critical · affected_sectors: [global] · au_impact: false
Cisco Talos detailed UAT-11473, a sophisticated APT that exploited CVE-2026-20127 — a CVSS 10.0 authentication-bypass flaw in Cisco Catalyst SD-WAN Controller, Manager and Validator components patched in February — to install a custom framework named KeyDrift on SD-WAN controllers.
| Attribute | Detail |
|---|---|
| CVE | CVE-2026-20127 |
| CVSS | 10.0 (CRITICAL) |
| Vendor / product | Cisco Catalyst SD-WAN Controller and Manager |
| Reported | 2026-10-30 |