Cisco Talos has identified UAT-11473, a highly sophisticated advanced persistent threat (APT) actor, who exploited CVE-2026-20127, an authentication bypass vulnerability in Cisco SD-WAN Catalyst Controller instances to bypass authentication and gain unauthorized access to affected systems.
Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN
About this summary. This is a short excerpt from the description that Cisco Talos published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://blog.talosintelligence.com/uat-11473-keydrift/
Source attribution: headline and facts are from Cisco Talos (blog.talosintelligence.com). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability
A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and…
Critical Cisco Catalyst SD-WAN Manager API authentication bypass exploited in the wild (CVE-2026-76504)
OverviewOn September 30, 2026, Cisco published a security advisory for CVE-2026-76504, a critical API authentication bypass vulnerability affecting Cisco Catalyst SD-WAN…
Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Tunnel Denial of Service Vulnerability
A vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD)…
From federal SOCs to Talos: Ryan Fetterman on practical security research
What does it mean to be "blue collar" for the blue team? Amy sat down with security researcher Ryan Fetterman to discuss his journey from federal agency work to his new…
Hidden Backdoor Attack on Deep Contrastive Clustering
arXiv:2610.33116v1 Announce Type: new Abstract: Deep contrastive clustering has become a representative paradigm for unsupervised image clustering, yet its security…
One Week, Five Flaws, Same Weak Point: The Management Layer
Five actively exploited flaws hit the same target this week: the management layer. See how Cisco FMC, hardcoded credentials, and Qilin connect.