Will CVE-2026-20127 (Cisco SD-WAN auth-bypass) be added to CISA KEV by Dec 2026?

Cisco SD-WAN Controllers flaw (CVE-2026-20127) is being actively exploited by APT group UAT-11473 to deploy KeyDrift malware. This authentication-bypass vulnerability has demonstrated real-world weaponization by a known threat actor, per Bleeping Computer.

Resolution Criteria

Confirmed by CISA KEV Catalog official listing, or official Cisco/CISA advisory confirming active exploitation and KEV addition. Moderator may reference CISA.gov/known-exploited-vulnerabilities.