Cisco SD-WAN CVE-2026-20127 exploited to install KeyDrift key-stealing malware
Original title: Hackers Exploited Cisco SD-WAN Flaw to Plant Malware Built to Steal Encryption Keys
The malware hooks vdaemon to copy AES-256 key material; Cisco calls exploitation limited and lists fixed trains.
Cisco Talos said on October 28 that attackers exploited CVE-2026-20127, a critical authentication bypass in Catalyst SD-WAN Controller, Manager, and Validator, to install KeyDrift. The malware, deployed through modified runit scripts, copies AES key material handled by vdaemon. Cisco says exploitation is limited, there is no workaround, and several release trains are already end of maintenance. Talos does not date the KeyDrift intrusions or confirm that collected keys left the devices.
Unconfirmed: Talos does not equate UAT-11473 with Volt Typhoon or UAT-8616; Lumen's Volt Typhoon exploitation claim is not tied to KeyDrift, and key exfiltration is unconfirmed.
- CVE-2026-20127 scores CVSS 10.0 and was fixed in February; Validator was added June 16.
- On a Controller, the attacker logs in as a high-privileged internal account, not root.
- LittleFilch reads decrypted control messages and can send RSA-wrapped data over UDP.
- PolyFlame is an in-memory TinyShell-like backdoor that rsshd injects into vdaemon.
- Talos tracks the operators as UAT-11473 and rates Silent Train overlap as high confidence.
Impact: Unauthenticated admin access and theft of SD-WAN AES keys
| Product | Affected | Fixed in |
|---|---|---|
| Cisco Catalyst SD-WAN Controller, Manager, and Validator | All configurations, on-premises and hosted Managed and FedRAMP deployments | 20.9.8.2; 20.12.5.3 or 20.12.6.1; 20.15.4.2; 20.18.2.1; migrate if earlier than 20.9 |
- 1.Install the first fixed release for the relevant Catalyst SD-WAN train.
- 2.Until upgrade, limit ports 22 and 830 to known controllers and systems.
- 3.Hunt for conf_sshd, rsshd, aaamgrd, and the fake aaamgr service, then start incident response.
- CVEs
- CVE-2026-20127
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1055 Process InjectionT1552.004 Unsecured Credentials: Private KeysT1070.006 TimestompT1048 Exfiltration Over Alternative Protocol
- Vendors
- Cisco
- Threat actors
- UAT-11473UAT-8616Volt Typhoon
- Malware
- KeyDriftLittleFilchPolyFlame
- Organizations
- Cisco TalosLumenBlack Lotus LabsCISANSAFBI
- Countries
- China
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-20127 | Authentication Bypass in Cisco Catalyst SD-WAN Controller, Manager, Validator | 10.0 | 89% | KEV | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 20.12.5.3 | rate to a fixed release 20.9 20.9.8.2 20.11 20.12.6.1 20.12 20.12.5.3 or 20.12.6.1 20.13 20.15.4.2 20.14 20.15.4.2 20.15 20.15.4. |
| ipv4 | 20.12.6.1 | er than 20.9 Migrate to a fixed release 20.9 20.9.8.2 20.11 20.12.6.1 20.12 20.12.5.3 or 20.12.6.1 20.13 20.15.4.2 20.14 20.15.4. |
| ipv4 | 20.15.4.2 | 20.9.8.2 20.11 20.12.6.1 20.12 20.12.5.3 or 20.12.6.1 20.13 20.15.4.2 20.14 20.15.4.2 20.15 20.15.4.2 20.16 20.18.2.1 20.18 20.18 |
| ipv4 | 20.18.2.1 | 2.6.1 20.13 20.15.4.2 20.14 20.15.4.2 20.15 20.15.4.2 20.16 20.18.2.1 20.18 20.18.2.1 Releases earlier than 20.9 and the 20.11, 2 |
| ipv4 | 20.9.8.2 | d release Earlier than 20.9 Migrate to a fixed release 20.9 20.9.8.2 20.11 20.12.6.1 20.12 20.12.5.3 or 20.12.6.1 20.13 20.15.4. |
From the original article
5 min read at thehackernews.com
Hackers exploited a critical Cisco Catalyst SD-WAN flaw, fixed in February, to plant custom malware inside the systems that control an organization's SD-WAN network. The malware, called KeyDrift, is designed to copy the keys that encrypt traffic between sites and store them for later use, Cisco Talos said on October 28. Talos calls the attacks historical but does not specify when they
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.