Attackers Exploit Cisco SD-WAN Vulnerability to Deploy KeyDrift Malware

The threat actor UAT-11473 has exploited CVE-2026-20127 to deploy a custom malware framework called KeyDrift. The vulnerability allows unauthenticated remote attackers to gain privileged access to affected Cisco Catalyst SD-WAN systems and manipulate network configurations. KeyDrift is designed to maintain persistent access, execute commands, intercept control-plane traffic, and steal sensitive cryptographic key material. Reported targets include space and satellite services, defense and aerospace technology, and policy research organizations.