KeyDrift malware steals SD-WAN encryption keys from Cisco Catalyst SD-WAN controllers hacked through CVE-2026-20127
Cisco Catalyst SD-WAN Controller, Manager and Validator
Cisco Talos said on Oct 28 2026 that an APT it tracks as UAT-11473 exploited CVE-2026-20127, the CVSS 10.0 authentication bypass in Cisco Catalyst SD-WAN Controller, Manager and Validator that Cisco fixed in February, and installed a custom malware framework called KeyDrift. Its PolyFlame module is injected into the controller's vdaemon processes as an in-memory backdoor and relay, and its LittleFilch module hooks SSL_read to pull AES-256 key material for a preset list of edge routers out of decrypted control traffic, staging it encrypted for exfiltration. Talos calls the activity historical, says targets included space and satellite services, defense and aerospace technology and policy research, and assesses with high confidence that the group's infrastructure overlaps with Volt Typhoon's Silent Train covert network. There is no workaround; upgrade to a fixed release and check controllers for compromise.
Why this severity: CVSS 10.0 unauthenticated auth bypass (Cisco); exploited by a state-linked APT to plant key-stealing malware on SD-WAN controllers (Talos)
- Started
- Oct 28, 2026
Affected
- Cisco Catalyst SD-WAN releases earlier than 20.9 (migrate to a fixed release)
- 20.9 before 20.9.8.2
- 20.11 (end of maintenance; fixed in 20.12.6.1)
- 20.12 before 20.12.5.3 / 20.12.6.1
- 20.13, 20.14 (end of maintenance) and 20.15 before 20.15.4.2
- 20.16 (end of maintenance) and 20.18 before 20.18.2.1
Fixed in
- 20.9.8.2
- 20.12.5.3
- 20.12.6.1
- 20.15.4.2
- 20.18.2.1
Timeline4
Cisco Talos details KeyDrift, a malware framework UAT-11473 planted on SD-WAN controllers through CVE-2026-20127 to steal edge-router AES-256 key material, and releases Snort rules for its command-and-control traffic.
Lumen says Volt Typhoon was exploiting CVE-2026-20127 by late 2025 and kept exploiting it after Cisco's February disclosure, per The Hacker News.
Cisco adds Catalyst SD-WAN Validator (formerly vBond) to the affected products in its advisory.
Cisco discloses CVE-2026-20127, a CVSS 10.0 peering authentication bypass in Catalyst SD-WAN Controller and Manager, as exploited in the wild; CISA adds it to KEV.
Advisories3
News & write-ups2
Get an email when a new major security incident drops. No spam, unsubscribe any time.
