# KeyDrift malware steals SD-WAN encryption keys from Cisco Catalyst SD-WAN controllers hacked through CVE-2026-20127 · pwn.watch > Cisco Talos said on Oct 28 2026 that an APT it tracks as UAT-11473 exploited CVE-2026-20127, the CVSS 10.0 authentication bypass in Cisco Catalyst SD-WAN Controller, Manager and Validator that Cisco fixed in February, and installed a custom malware framework called KeyDrift. Its PolyFlame module is injected into the controller's vdaemon processes as an in-memory backdoor and relay, and its LittleFilch module hooks SSL_read to pull AES-256 key material for a preset list of edge routers out of decrypted control traffic, staging it encrypted for exfiltration. Talos calls the activity historical, says targets included space and satellite services, defense and aerospace technology and policy research, and assesses with high confidence that the group's infrastructure overlaps with Volt Typhoon's Silent Train covert network. There is no workaround; upgrade to a fixed release and check controllers for compromise. Page: https://pwn.watch/i/cisco-sd-wan-keydrift-uat-11473-cve-2026-20127 · generated 2026-10-29T12:29:19.972Z ## Status - Severity: critical · status: live · patch: patched - Product: Cisco Catalyst SD-WAN Controller, Manager and Validator - Started: 2026-10-28 - CVEs: CVE-2026-20127 - Affected: Cisco Catalyst SD-WAN releases earlier than 20.9 (migrate to a fixed release); 20.9 before 20.9.8.2; 20.11 (end of maintenance; fixed in 20.12.6.1); 20.12 before 20.12.5.3 / 20.12.6.1; 20.13, 20.14 (end of maintenance) and 20.15 before 20.15.4.2; 20.16 (end of maintenance) and 20.18 before 20.18.2.1 - Fixed in: 20.9.8.2; 20.12.5.3; 20.12.6.1; 20.15.4.2; 20.18.2.1 ## Follow this incident - RSS (one item per update): https://pwn.watch/i/cisco-sd-wan-keydrift-uat-11473-cve-2026-20127/feed.xml - JSON Feed: https://pwn.watch/i/cisco-sd-wan-keydrift-uat-11473-cve-2026-20127/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/cisco-sd-wan-keydrift-uat-11473-cve-2026-20127.json - This file: https://pwn.watch/i/cisco-sd-wan-keydrift-uat-11473-cve-2026-20127/llms.txt ## Updates (newest first) - 2026-10-28: Cisco Talos details KeyDrift, a malware framework UAT-11473 planted on SD-WAN controllers through CVE-2026-20127 to steal edge-router AES-256 key material, and releases Snort rules for its command-and-control traffic. (https://blog.talosintelligence.com/uat-11473-keydrift/) - 2026-10-28: Lumen says Volt Typhoon was exploiting CVE-2026-20127 by late 2025 and kept exploiting it after Cisco's February disclosure, per The Hacker News. (https://thehackernews.com/2026/10/hackers-exploited-cisco-sd-wan-flaw-to.html) - 2026-06-16: Cisco adds Catalyst SD-WAN Validator (formerly vBond) to the affected products in its advisory. (https://thehackernews.com/2026/10/hackers-exploited-cisco-sd-wan-flaw-to.html) - 2026-02-25: Cisco discloses CVE-2026-20127, a CVSS 10.0 peering authentication bypass in Catalyst SD-WAN Controller and Manager, as exploited in the wild; CISA adds it to KEV. (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk) ## Fix brief # Security brief: KeyDrift malware steals SD-WAN encryption keys from Cisco Catalyst SD-WAN controllers hacked through CVE-2026-20127 Source: https://pwn.watch/i/cisco-sd-wan-keydrift-uat-11473-cve-2026-20127 · status: live · severity: critical · updated Oct 29, 2026, 10:45 UTC ## Patch status **PATCHED: fixed releases exist. Upgrade to a fixed version.** ## What it is Cisco Talos said on Oct 28 2026 that an APT it tracks as UAT-11473 exploited CVE-2026-20127, the CVSS 10.0 authentication bypass in Cisco Catalyst SD-WAN Controller, Manager and Validator that Cisco fixed in February, and installed a custom malware framework called KeyDrift. Its PolyFlame module is injected into the controller's vdaemon processes as an in-memory backdoor and relay, and its LittleFilch module hooks SSL_read to pull AES-256 key material for a preset list of edge routers out of decrypted control traffic, staging it encrypted for exfiltration. Talos calls the activity historical, says targets included space and satellite services, defense and aerospace technology and policy research, and assesses with high confidence that the group's infrastructure overlaps with Volt Typhoon's Silent Train covert network. There is no workaround; upgrade to a fixed release and check controllers for compromise. Severity detail: CVSS 10.0 unauthenticated auth bypass (Cisco); exploited by a state-linked APT to plant key-stealing malware on SD-WAN controllers (Talos) - Product: Cisco Catalyst SD-WAN Controller, Manager and Validator - CVE / advisory ids: CVE-2026-20127 ## Affected versions - Cisco Catalyst SD-WAN releases earlier than 20.9 (migrate to a fixed release) - 20.9 before 20.9.8.2 - 20.11 (end of maintenance; fixed in 20.12.6.1) - 20.12 before 20.12.5.3 / 20.12.6.1 - 20.13, 20.14 (end of maintenance) and 20.15 before 20.15.4.2 - 20.16 (end of maintenance) and 20.18 before 20.18.2.1 ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix Upgrade to one of these fixed versions (or later on the same branch): - 20.9.8.2 - 20.12.5.3 - 20.12.6.1 - 20.15.4.2 - 20.18.2.1 After upgrading, re-run the checks above and redeploy/restart the affected services. ## Secrets to rotate This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs. ## Specific notes Upgrade Catalyst SD-WAN Controller, Manager and Validator to 20.9.8.2, 20.12.5.3 or 20.12.6.1, 20.15.4.2, or 20.18.2.1 (end-of-maintenance trains must move to a supported fixed release). Until then, on-prem users can limit ports 22 and 830 to known controller IPs, which does not remove existing malware. Check /var/log/auth.log for 'Accepted publickey for vmanage-admin' from unknown IPs, look for KeyDrift files such as a modified etc/sv/sshd run script, /etc/sv/aaamgr/, conf_sshd, rsshd, libdssl.so, libcommon.so, /tmp/system-vdaemon and /var/tmp/vdaemon.bin, and run 'request admin-tech' on each control component before opening a Cisco TAC case. ## Latest updates - Oct 28, 2026: Cisco Talos details KeyDrift, a malware framework UAT-11473 planted on SD-WAN controllers through CVE-2026-20127 to steal edge-router AES-256 key material, and releases Snort rules for its command-and-control traffic. - Oct 28, 2026: Lumen says Volt Typhoon was exploiting CVE-2026-20127 by late 2025 and kept exploiting it after Cisco's February disclosure, per The Hacker News. - Jun 16, 2026: Cisco adds Catalyst SD-WAN Validator (formerly vBond) to the affected products in its advisory. - Feb 25, 2026: Cisco discloses CVE-2026-20127, a CVSS 10.0 peering authentication bypass in Catalyst SD-WAN Controller and Manager, as exploited in the wild; CISA adds it to KEV. ## Advisories - [Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN](https://blog.talosintelligence.com/uat-11473-keydrift/) (Cisco Talos) - [Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability (cisco-sa-sdwan-rpa-EHchtZk)](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk) (Cisco) - [NVD: CVE-2026-20127](https://nvd.nist.gov/vuln/detail/CVE-2026-20127) (NVD) ## Write-ups & news - [Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon's 'Silent Train' Network](https://www.securityweek.com/cisco-sd-wan-zero-day-exploitation-tied-to-volt-typhoons-silent-train-network/) - [Hackers Exploited Cisco SD-WAN Flaw to Plant Malware Built to Steal Encryption Keys](https://thehackernews.com/2026/10/hackers-exploited-cisco-sd-wan-flaw-to.html) --- Machine-readable: https://pwn.watch/i/cisco-sd-wan-keydrift-uat-11473-cve-2026-20127.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.