Volt Typhoon-linked actor exploited Cisco SD-WAN zero-day to steal encryption keys

CVE-2026-20127 (CVSS 10) gives unauthenticated admin access to SD-WAN controllers; KeyDrift malware siphoned keying material and Volt Typhoon kept exploiting the flaw after disclosure.

Cisco Talos reported that a threat actor it tracks as UAT-11473 exploited the critical Cisco SD-WAN vulnerability CVE-2026-20127 to deploy a malware framework named KeyDrift on controllers, harvesting keying material including keys protecting data-plane traffic. The vulnerability, disclosed in February 2026 with a CVSS score of 10, lets unauthenticated attackers bypass peering authentication of SD-WAN controller components and obtain admin rights. Talos assessed with high confidence that UAT-11473's infrastructure overlaps considerably with Volt Typhoon's Silent Train covert network, which Lumen's Black Lotus Labs has monitored since late 2023. Black Lotus linked Silent Train to at least four confirmed zero-day campaigns against management platforms, including this Cisco flaw, which Volt Typhoon was exploiting by late 2025 and continued to exploit long after disclosure; victims include telecoms, government entities, defense contractors and critical infrastructure operators, most in Hawaii, California and Texas.

Unconfirmed: Talos says the infrastructure overlaps with but does not confirm UAT-11473 and Volt Typhoon are the same group; Talos calls the activity historical without giving dates.