Cisco Talos says attackers exploited an authentication bypass in SD-WAN controllers

Cisco Talos says attackers exploited a critical authentication bypass in Cisco SD-WAN Catalyst Controller systems, using custom malware to maintain access and steal sensitive control-plane material. The report makes this a prompt security concern for organisations running the affected product, though it does not identify affected software versions in the supplied details.

Cisco Watch analysis

What happened

Cisco Talos tracks the activity to a group it calls UAT-11473 and names the malware framework KeyDrift. Talos says its components can maintain access, execute commands and exfiltrate control-plane keying material. The vulnerability is identified as CVE-2026-20127.

Talos says Cisco has released patches across multiple software release trains and recommends hardening affected systems. Its report describes historical activity, but the supplied account does not specify when the exploitation began or which versions are affected.

Why it matters

An authentication bypass can put systems within reach without the usual access checks. Talos’s account also raises the stakes beyond unauthorised entry: it says attackers sought material used to secure the SD-WAN control plane. Organisations operating these controllers should establish whether their deployments are affected and consult Cisco’s advisory for version-specific remediation.

Our read

This is an urgent, actionable security warning from Cisco Talos, not a reason to guess which installations are vulnerable. Operators should check Cisco’s guidance for CVE-2026-20127 and apply the relevant fixes and hardening measures. In security, “we’ll get to it after the next change window” has a habit of becoming an expensive sentence.

What to watch

• Cisco’s version-specific guidance and patch instructions for CVE-2026-20127.
• Further detail from Cisco Talos on the affected systems and observed activity.
• Whether Talos publishes additional evidence about the targeting and stolen material.

Discussion spark: For critical network infrastructure, should organisations prioritise applying a vendor patch immediately, or wait for version-specific confirmation that their own systems are affected?

not affiliated with or endorsed by Cisco