Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN

vulnerability

Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN

Cisco Talos has identified a sophisticated APT group, UAT-11473, leveraging a vulnerability (CVE-2026-20127) in Cisco SD-WAN Catalyst Controller instances to install a custom malware framework called ‘KeyDrift’. Cisco re…

Cisco Talos · 22h ago CriticalCVSS 10.0KEVEPSS 89%

CVE-2026-20127 apt authentication bypass cisco

vulnerability

Hackers Exploited Cisco SD-WAN Flaw to Plant Malware Built to Steal Encryption Keys

Hackers exploited a critical Cisco SD-WAN flaw, initially tracked as UAT-8616 and discovered in February, to install malware called KeyDrift. Cisco recommends immediate patching and implementing security measures to miti…

The Hacker News · 12h ago CriticalCVSS 10.0KEVEPSS 89%

CVE-2026-20127 CN sd-wan cisco vulnerability

vulnerability

Cisco Patches Actively Exploited ASA and FTD VPN Flaw That Can Crash Firewalls

Cisco has released patches to address a high-severity vulnerability (CVE-2026-76418) actively being exploited in the wild, impacting their Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defe…

The Hacker News · 9h ago CriticalCVSS 10.0KEVEPSS 89%

CVE-2026-76418 CVE-2026-20127 asa ftd vpn

news.mlab.sh

Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN