Authentication Bypass in Cisco SD‑WAN Catalyst Controller (CVE‑2026‑20127) Enables KeyDrift APT Access
What It Is — Cisco Talos reports that the APT group UAT‑11473 is exploiting CVE‑2026‑20127, an authentication‑bypass flaw in Cisco SD‑WAN Catalyst Controller instances. The vulnerability lets the attacker skip login, inject a custom “KeyDrift” malware framework, and reside inside the controller’s control‑plane processes. KeyDrift’s components (PolyFlame, LittleFilch, etc.) hook system calls, capture decrypted DTLS traffic, harvest keying material for edge nodes, and stage it for encrypted exfiltration. The activity has been observed against organizations in satellite services, defense/aerospace, and policy‑research sectors.
Affected Products — Cisco SD‑WAN Catalyst Controller (all versions vulnerable to CVE‑2026‑20127).
Why It Matters for Trust & Control Assurance — The exploit demonstrates a failure of authentication and privileged‑access controls, a core control‑objective that underpins many frameworks (e.g., NIST CSF 2.0).
Recommended Actions —
- Deploy Cisco’s patch for CVE‑2026‑20127 immediately.
- Enforce multi‑factor authentication for all controller‑admin accounts.
- Harden runit service paths and verify integrity of daemon binaries.
- Enable detailed logging of authentication attempts and controller‑plane process activity; forward logs to a SIEM for continuous monitoring.
- Conduct a focused audit of keying material handling and isolate SD‑WAN controllers from untrusted networks.
Source: Cisco Talos – Inside KeyDrift: Analyzing historical UAT‑11473 activity on Cisco SD‑WAN