Act today High Known exploited Check your exposure
State-linked group exploits Cisco SD-WAN flaw to plant KeyDrift backdoor
Cisco TalosCisco · space and satellite, defence and aerospace, policy researchCVE-2026-20127
What happened. Cisco Talos says an advanced threat group, UAT-11473, used CVE-2026-20127, an authentication bypass in Cisco SD-WAN Catalyst Controller, to gain access. It then installed KeyDrift malware to collect keying material and act as a backdoor.
Who is affected. Organisations running Cisco SD-WAN Catalyst Controller. Observed targets are space and satellite services, defence and aerospace technology, and policy research.
What to do. Check whether you run Cisco SD-WAN Catalyst Controller and review it for signs of compromise. Apply Cisco's fix for CVE-2026-20127 if the vendor provides one.
When to act. Act today: on CISA's list of known exploited flaws
Editor's reading
ForOT security leaddetection engineerIT security
- Purdue level
- L4
- L3.5
Why: SD-WAN controllers link sites over the wide-area network, so they sit at the boundary between enterprise IT (L4) and industrial networks (L3.5).
- Are you exposed?
Search your asset inventory for Cisco SD-WAN Catalyst Controller instances and check whether their management interfaces are reachable from untrusted networks.
- If you cannot fix it yet
- Restrict management and control-plane access to the SD-WAN controllers to known administration hosts only.
- Block internet exposure of controller interfaces that do not need it.
- Rotate keys and certificates held on any controller suspected of compromise.
- Watch for
- Unexpected logons or new sessions to SD-WAN controllers that bypass normal authentication, especially from unfamiliar addresses.
- Unusual outbound traffic from controllers, which may indicate KeyDrift acting as an intermediate command-and-control host.
- ATT&CK for ICS
- T0866Exploitation of Remote Services
Inferred from the facts above, not stated by the source. Check it against your own site before acting.
Source: Cisco Talos (opens blog.talosintelligence.com)
More on Cisco Defence and aerospace CVE-2026-20127