Hackers exploit Cisco SD-WAN flaw to deploy custom KeyDrift malware
CVE-2026-20127, patched in February 2026, lets attackers add rogue peers and steal IPsec key material from controllers.
Cisco Talos says the cluster UAT-11473 is exploiting CVE-2026-20127, a maximum-severity authentication bypass in Cisco Catalyst SD-WAN Controllers, to install a custom framework called KeyDrift. The flaw, patched in February 2026, gives remote attackers privileged access and lets them add rogue peers. Observed targets include space and satellite services, defense and aerospace technology, and policy research organizations. KeyDrift’s PolyFlame and LittleFilch components run inside controller processes, intercept decrypted control traffic, and exfiltrate what Talos assesses is AES-256 IPsec key material.
Unconfirmed: Talos says UAT-11473 appears to overlap with Volt Typhoon’s Silent Train network but made no definitive link.
- Talos assesses with high confidence that KeyDrift is built for long-term access and key theft.
- PolyFlame injects into vdaemon and supports commands, file transfer, and C2 relay.
- LittleFilch hooks SSL_read, stores data in /var/tmp/vdaemon.bin, and sends it over UDP.
- UAT-8616 has exploited the same flaw as a zero-day since at least 2023.
- Cisco advises applying the CVE-2026-20127 updates and its SD-WAN hardening guide.
Impact: Privileged controller access and theft of IPsec key material
| Product | Affected |
|---|---|
| Cisco Catalyst SD-WAN Controller and Manager | — |
- 1.Apply Cisco’s available security updates for CVE-2026-20127.
- 2.Consult Cisco’s hardening guide for Catalyst SD-WAN deployments.
- CVEs
- CVE-2026-20127
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1055 Process InjectionT1048 Exfiltration Over Alternative ProtocolT1552.004 Private KeysT1105 Ingress Tool Transfer
- Vendors
- Cisco
- Threat actors
- UAT-11473UAT-8616Volt Typhoon
- Organizations
- Cisco TalosLumen
- Countries
- China
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-20127 | Authentication Bypass in Cisco Catalyst SD-WAN Controller, Manager, Validator | 10.0 | 89% | KEV | KEV |
From the original article
2 min read at bleepingcomputer.com
A newly identified advanced persistent threat (APT) group tracked as UAT-11473 was observed exploiting CVE-2026-20127, an authentication-bypass flaw in Cisco Catalyst SD-WAN Controllers, to deploy a custom malware framework called KeyDrift. [...]
By Bill Toulas · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.