Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN
Admiralty grading (A–F · 1–6)
Source reliability
- A Completely reliable
- B Usually reliable
- C Fairly reliable
- D Not usually reliable
- E Unreliable
- F Cannot be judged
Information credibility
- 1 Confirmed
- 2 Probably true
- 3 Possibly true
- 4 Doubtful
- 5 Improbable
- 6 Cannot be judged
NATO Admiralty (AJP-2.1) grades confidence, independent of the risk score. Cross-source corroboration isn't tracked for non-CVE news, so single-source items are capped at a lower credibility number; a low number does not imply low quality.
Key metrics
- CVSS
- 10.0
- EPSS
- 88%
- KEV due date
- 27 February 2026
Affected versions
Key insight
The report shows that a state-backed actor uses an authentication bypass in a network management appliance not merely for access but as a persistent operational base with its own malware framework called KeyDrift.
Description
Cisco Talos documents the activity of a group tracked as UAT-11473 that exploited an authentication bypass (CVE-2026-20127) in Cisco SD-WAN Catalyst Controller instances to gain access to affected systems without credentials. After access, the actor installed a framework tracked as KeyDrift consisting of several components: PolyFlame interacts with the vdaemon process via libdssl.so and intercepts control-plane data, rsshd injects the library into running processes using Ptrace, conf_sshd enumerates process IDs via the shell, and a trojanized Runit service plus a packed aaamgrd loader with direct syscalls and anti-debugging complete the chain. Observed targets are in space and satellite services, defense and aerospace technology, and policy research. Snort rules are available for the vulnerability (SIDs 65938, 65958) as well as for the malicious artifacts. The authors frame the analysis as a historical reconstruction of the activity, and the exact command syntax of PolyFlame remains unresolved.
Risk score
- strategic relevance
- 0.75
Path: strategic