Vendors and CVEs › CVEs › CVE-2026-20127
CVE-2026-20127: what it is, who is affected and what to do
Cisco Talos says an advanced threat group, UAT-11473, used CVE-2026-20127, an authentication bypass in Cisco SD-WAN Catalyst Controller, to gain access. It then installed KeyDrift malware to collect keying material and act as a backdoor.
- Known exploited. Yes, on CISA’s list of exploited flaws.
- Records. CVE-2026-20127 on the National Vulnerability Database · CISA’s known exploited catalog
The story
High Known exploited
State-linked group exploits Cisco SD-WAN flaw to plant KeyDrift backdoor
Cisco Talos says an advanced threat group, UAT-11473, used CVE-2026-20127, an authentication bypass in Cisco SD-WAN Catalyst Controller, to gain access.