Cisco SD-WAN zero-day CVE-2026-20127 used to install KeyDrift
Original title: Hackers Exploit Critical Cisco SD-WAN 0-Day Flaw to Deploy KeyDrift Malware and Steal Encryption Keys
Talos says UAT-11473 stole suspected IPsec keys from space, defense, and policy targets; patches shipped in February 2026.
Cisco Talos said on October 28, 2026 that UAT-11473 used CVE-2026-20127, a CVSS 10.0 authentication bypass in Catalyst SD-WAN Controller, Manager, and Validator peering, to gain administrative access and deploy the KeyDrift framework. PolyFlame is an in-memory backdoor injected into vdaemon, while LittleFilch hooks SSL_read and collects IP addresses and a 32-byte field Talos believes is AES-256 IPsec key material. Cisco says there is no workaround. A public proof of concept exists, and Talos also says CVE-2026-20182, another vdaemon flaw, was exploited.
Unconfirmed: Talos does not date the intrusions or confirm that stolen keys left the network; the Volt Typhoon tie is an infrastructure overlap.
- Fixed releases named are 20.9.8.2, 20.12.6.1, 20.15.4.2, and 20.18.2.1.
- Versions older than 20.9 must move to a supported release.
- Talos rates infrastructure overlap with Silent Train, linked to Volt Typhoon, as high confidence.
- Until upgrade, Cisco advises limiting ports 22 and 830 to known controller addresses.
- Look for unknown “Accepted publickey for vmanage-admin” entries in /var/log/auth.log.
Impact: Admin access and theft of suspected IPsec keys
| Product | Affected | Fixed in |
|---|---|---|
| Cisco Catalyst SD-WAN Controller | older than 20.9 unsupported | 20.9.8.2, 20.12.6.1, 20.15.4.2, 20.18.2.1 |
| Cisco Catalyst SD-WAN Manager | older than 20.9 unsupported | 20.9.8.2, 20.12.6.1, 20.15.4.2, 20.18.2.1 |
| Cisco Catalyst SD-WAN Validator | older than 20.9 unsupported | 20.9.8.2, 20.12.6.1, 20.15.4.2, 20.18.2.1 |
- 1.Upgrade to 20.9.8.2, 20.12.6.1, 20.15.4.2, or 20.18.2.1 for the matching train.
- 2.Restrict ports 22 and 830 to known controller addresses until systems are patched.
- 3.Hunt listed KeyDrift files and unknown vmanage-admin public-key logins, and review CVE-2026-20182.
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1055 Process InjectionT1543 Create or Modify System ProcessT1552.004 Unsecured Credentials: Private Keys
- Vendors
- Cisco
- Threat actors
- UAT-11473Volt Typhoon
- Organizations
- Cisco Talos
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-20127 | Authentication Bypass in Cisco Catalyst SD-WAN Controller, Manager, Validator | 10.0 | 89% | KEV | KEV |
| CVE-2026-20182 | Authentication Bypass in Cisco Catalyst SD-WAN Control Components | 10.0 | 92% | KEV | KEV |
From the original article
4 min read at cybersecuritynews.com
A state-linked hacking group used a maximum-severity Cisco SD-WAN zero-day flaw to break into network controllers and install a custom malware framework called KeyDrift. The flaw is CVE-2026-20127. It carries a CVSS score of 10.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.