A group that Cisco Talos tracks as UAT-11473 broke into Cisco Catalyst SD-WAN controllers through a maximum-severity flaw and installed custom malware designed to steal network keying material, Talos said on 28 October. The flaw, CVE-2026-20127, has had fixed software since February, and Cisco says there is no workaround.
Talos describes the activity as historical and gives no dates, victim names or countries. It calls UAT-11473 a “highly sophisticated advanced persistent threat (APT) actor” and says observed targeting covered “space and satellite services, defense and aerospace technology, and policy research.”
The flaw: an authentication bypass rated 10.0
Cisco’s security advisory rates CVE-2026-20127 at 10.0 on CVSS 3.1, the top of the scale. It sits in the peering authentication of three parts of the Catalyst SD-WAN control plane: the Controller (formerly vSmart), the Manager (formerly vManage) and the Validator (formerly vBond). Every configuration is affected, across on-premises deployments and Cisco’s hosted SD-WAN cloud, including its FedRAMP environment.
According to Cisco, an unauthenticated attacker on the network can send crafted requests and log in as an internal, high-privileged account. From there, the attacker can reach NETCONF and change the configuration of the SD-WAN fabric, the system that steers traffic between an organisation’s sites.
Cisco first published the advisory on 25 February 2026, crediting the Australian Signals Directorate’s Australian Cyber Security Centre with reporting the bug. It added the Validator to the affected list in June. On 28 October it updated the advisory again to link the Talos research. “The Cisco PSIRT is aware of limited exploitation of this vulnerability,” the advisory says.
What KeyDrift does
Talos says that after getting in, UAT-11473 installed a malware framework it calls KeyDrift. It has two main parts.
The first, PolyFlame, lives in memory inside vdaemon, a legitimate SD-WAN controller process. Talos says it acts as a backdoor that can read and write files and run commands, and as a relay that passes instructions between the attackers and other peers. Talos says it is designed to be controlled through normal SD-WAN control-plane traffic rather than by calling out to a fixed server.
The second, LittleFilch, hooks the point where the controller decrypts its own control traffic. Talos says it pulls out keying material for a predefined list of edge devices, which Talos assesses to be the keys used to encrypt traffic between sites, and stores it encrypted for later theft.
“Talos assesses with high confidence that the framework is designed to provide long-term persistent access and automated exfiltration of sensitive keying material,” the researchers write. They add that different versions of the modules “suggest active development of the framework’s capabilities.”
The Volt Typhoon overlap, and its limits
Talos says, with high confidence, that UAT-11473’s operating infrastructure “overlaps considerably with Volt Typhoon’s ‘Silent Train’ covert access network.” That is a statement about shared infrastructure. Talos does not say that Volt Typhoon carried out these intrusions, and it attributes UAT-11473 to no country.
Silent Train is the network of short-lived chains of hacked routers and servers that Lumen’s Black Lotus Labs described on 28 October. As TSN reported from Lumen’s study, Lumen says the group behind it was exploiting CVE-2026-20127 by late 2025. Lumen has also linked Silent Train to a VeloCloud Orchestrator zero-day; Arista patched another exploited VeloCloud flaw last week.
Patching and hardening steps
Cisco’s fixed releases are 20.9.8.2, 20.12.5.3 or 20.12.6.1, 20.15.4.2 and 20.18.2.1, depending on the release train. Systems older than 20.9 must migrate to a fixed release, and several trains are past the end of software maintenance. Until upgrades are done, Cisco suggests access lists or firewall rules that limit ports 22 and 830 to known controller addresses.
Talos says organisations should “prioritize the application of these patches” and follow Cisco’s Catalyst SD-WAN hardening guide. It also urges teams to look for signs of earlier compromise and to start incident response if they find any. Cisco’s advisory tells customers to check /var/log/auth.log for “Accepted publickey for vmanage-admin” entries from unknown addresses, and to compare them with the system IPs listed in SD-WAN Manager. It also asks them to check unexpected peering events. Talos has published Snort rules for the flaw and for KeyDrift’s components.
Why stolen keys make this more than a patching job
This is TSN’s analysis. A patch closes the door that UAT-11473 used. It does not undo what happened while the door was open. KeyDrift was built to collect the material that protects traffic between sites, and Talos says it staged that material for exfiltration. An organisation that patched in February but never checked whether its controllers had already been compromised may have fixed the flaw without learning whether keys left the building.
That is why Cisco’s log checks and Talos’s call to hunt for post-compromise activity matter as much as the upgrade itself. The controllers sit at the centre of the network and see everything it does, which is exactly what made them worth targeting. The same pattern runs through this autumn’s edge-device attacks, from VeloCloud to Cisco’s own ASA and FTD VPN zero-day: attackers aim at the systems that manage other systems, and defenders can be the last to know.
The overlap with Silent Train also argues for caution, not alarm. Shared infrastructure can mean shared operators, rented access or something looser, and Talos has chosen not to go further. The checks Cisco has already published work whatever name the attacker ends up with.
Cisco has not announced a further update to the advisory. The next signal will be any new Talos indicators or a further advisory revision.
Sources
- Cisco Talos, “Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN”, 28 October 2026
- Cisco Security Advisory cisco-sa-sdwan-rpa-EHchtZk, “Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability”, first published 25 February 2026, updated 28 October 2026
- Cisco, Catalyst SD-WAN hardening guide
Related
- Lumen Says Volt Typhoon Exploited at Least Four Zero-Days for Access
- Arista Patches 9.9-Rated VeloCloud Orchestrator Zero-Day Under Attack
- Cisco Patches ASA and FTD VPN Zero-Day That Attackers Are Using
Related stories
- Lumen Says Volt Typhoon Exploited at Least Four Zero-Days for Access
- Arista Patches 9.9-Rated VeloCloud Orchestrator Zero-Day Under Attack
- Cisco Patches ASA and FTD VPN Zero-Day That Attackers Are Using
Follow @tsnmediahub on X for breaking AI news as it happens.
Follow on X
