Hackers Exploit Cisco SD-WAN 0-Day to Deploy KeyDrift Malware
First merged summary.
Volt Typhoon exploited Cisco SD-WAN flaw CVE-2026-20127 via Silent Train to deploy KeyDrift and steal IPsec keys; patches released February 2026.
Cisco Talos reported on October 28, 2026 that cluster UAT-11473 exploited CVE-2026-20127, a CVSS 10.0 authentication bypass in Catalyst SD-WAN Controllers, to gain admin access and deploy KeyDrift malware. The framework includes PolyFlame and LittleFilch components to steal AES-256 IPsec key material from space, defense and policy targets. Infrastructure overlaps with Silent Train, used by Volt Typhoon to target US government, telecom, defense and critical infrastructure via compromised devices. Patches for the flaw and related CVEs shipped in February 2026, with public proof-of-concept available. Cisco advises applying updates and hardening measures.
- CVE-2026-20127 exploited by UAT-11473 on Cisco Catalyst SD-WAN Controllers
- KeyDrift deploys PolyFlame backdoor in vdaemon and LittleFilch to hook SSL_read
- Targets include space, defense and policy organizations; high overlap with Silent Train
- Fixed versions 20.9.8.2, 20.12.6.1, 20.15.4.2, 20.18.2.1
- Patches shipped February 2026; public PoC exists
- Advise limiting ports 22 and 830 to known addresses until upgrade
Timeline
dated events in the reporting · oldest first- Feb 1, 2026Patches shipped for CVE-2026-20127 · Cyber Security News
- Oct 28, 2026Talos reports UAT-11473 exploiting SD-WAN flaw · Help Net Security
- Oct 29, 2026Outlets report Silent Train network targeting enterprise control planes · BleepingComputer
What each outlet adds
beyond the shared facts- Cyber Security NewsDetails on UAT-11473, KeyDrift components and Silent Train overlap
- Help Net SecurityBroader Silent Train network targeting multiple products including Versa and VeloCloud
- BleepingComputerSpecific KeyDrift malware analysis and targets like space and satellite services
Coverage
oldest first · one row per article · UTC- · 13d ago
Cyber Security NewsFirst report
Cisco SD-WAN zero-day CVE-2026-20127 used to install KeyDrift
Talos says UAT-11473 stole suspected IPsec keys from space, defense, and policy targets; patches shipped in February 2026.
- · 13d ago
Help Net Security
Volt Typhoon used rotating Silent Train relays for zero-days
Lumen says exploited products included Versa, N-able, Cisco SD-WAN, VeloCloud and possibly Quest KACE; KeyDrift hit Cisco controllers.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2024-39717 | Unrestricted File Upload in Versa Networks Versa Director Exploited by Volt Typhoon | 7.2 | 4% | KEV | KEV |
CVE-2025-8876+1 related CVE | OS Command Injection in N-able N-central Before 2025.3.1 | 9.4 | 4% | KEV | KEV |
| CVE-2026-16812 | OS Command Injection in Arista VeloCloud Orchestrator On-Prem | 10.0 | 2% | KEV | KEV |
| CVE-2026-20127 | Authentication Bypass in Cisco Catalyst SD-WAN Controller, Manager, Validator | 10.0 | 88% | KEV | KEV |
| CVE-2026-20182 | Authentication Bypass in Cisco Catalyst SD-WAN Control Components | 10.0 | 92% | KEV | KEV |