Talos has identified UAT-11473, a highly sophisticated APT, who exploited CVE-2026-20127, an authentication bypass vulnerability in Cisco SD-WAN Catalyst Controller instances to bypass authentication and gain unauthorized access to affected systems to deploy KeyDrift.
First seen on blog.talosintelligence.com
Jump to article: blog.talosintelligence.com/uat-11473-keydrift/
