Skip to content
audiotale.net
Sign in
NewsNews

CVE-2026-20127: Cisco Talos details KeyDrift malware that steals SD-WAN keys

Talos says UAT-11473 used the patched Catalyst SD-WAN authentication bypass to plant malware inside vdaemon and harvest control-plane and data-plane key material.

audiotale.net team

· 6 min read

Written by AI from the sources linked below. How we use AI

A section of Cisco's San Jose main campus
Photo: Travis Wise, CC BY 2.0, via Wikimedia Commons
On this page
  1. Key points
  2. What to do
  3. What happened
  4. Background
  5. How it works
  6. What it means
  7. What we don't know yet
  8. What to watch next
  9. Sources

Cisco Talos has published a technical analysis of KeyDrift, a custom malware framework that a group it tracks as UAT-11473 used against Cisco Catalyst SD-WAN control components after exploiting CVE-2026-20127, a maximum-severity authentication bypass that Cisco patched in February 2026. KeyDrift hides inside the legitimate vdaemon process and takes the keying material that protects SD-WAN traffic, so an attacker who has it can potentially read or forge encrypted traffic between sites. On October 28, 2026 Cisco updated its advisory to point to the Talos report. If you run SD-WAN controllers that were exposed to the internet and were not patched in time, patching alone does not tell you whether you were already compromised.

Key points

  • CVE-2026-20127 is a CVSS 10.0 authentication bypass (CWE-287) in Cisco Catalyst SD-WAN Controller, Manager and Validator, first published by Cisco on February 25, 2026 and updated on October 28, 2026.
  • Cisco says there is no workaround; fixed releases exist for every supported train, and Cisco PSIRT is aware of limited exploitation.
  • Talos describes KeyDrift, used by a cluster it names UAT-11473, as built for persistent access and for exfiltrating keying material, including what it assesses to be a 32-byte AES-256 data-plane key field.
  • Talos assesses with high confidence that UAT-11473 infrastructure overlaps considerably with Volt Typhoon's "Silent Train" network, and says it observed targeting of space and satellite services, defense and aerospace technology, and policy research.
  • Talos published no IP addresses, domains or file hashes, so detection relies on file paths, process behavior and Snort rules.

What to do

Who is affected. Cisco says Catalyst SD-WAN Controller (formerly vSmart), Manager (formerly vManage) and Validator (formerly vBond) are vulnerable regardless of device configuration, across on-premises, Hosted SD-WAN Cloud, Cisco Managed Hosted Cloud and FedRAMP deployments.

Fixed releases. Cisco's table is awkward to read in places; the Canadian Centre for Cyber Security reproduces it as follows (releases marked with an asterisk have reached End of Software Maintenance, and Cisco urges those customers to move to a supported release):

  • Earlier than 20.9*: migrate to a fixed release.
  • 20.9: 20.9.8.2.
  • 20.11*: 20.12.6.1.
  • 20.12.5: 20.12.5.3. 20.12.6: 20.12.6.1.
  • 20.13* and 20.14*: 20.15.4.2. 20.15: 20.15.4.2.
  • 20.16* and 20.18: 20.18.2.1.

Check the version for your train against Cisco's advisory before upgrading.

No workaround, but a stopgap. Cisco states no workaround addresses the flaw. For on-premises deployments it recommends, as a temporary mitigation, limiting traffic to ports 22 and 830 to known controller IP addresses and other trusted hosts using ACLs, security groups or firewall rules. Cisco says the guardrails are already in place for Hosted SD-WAN Cloud, FedRAMP and Cisco Managed Hosted Cloud.

How to check whether you were hit.

  • Review /var/log/auth.log for "Accepted publickey for vmanage-admin" entries from IP addresses that do not match your configured System IPs (Cisco's guidance).
  • Look for the artifacts Talos names: /tmp/system-vdaemon, /var/tmp/vdaemon.bin, /var/tmp/vdaemon.conf, modified runit scripts under /etc/sv/sshd/ and /etc/sv/aaamgr/, and remounts of /rootfs.rw.
  • Talos lists Snort coverage: SIDs 65938 and 65958 for the vulnerability, and Snort v2 SIDs 67387 to 67416 and Snort v3 SIDs 7:44 to 7:73 for the artifacts.
  • If you suspect compromise, run request admin-tech on each control component and open a Cisco TAC case.
  • Review the peers in your SD-WAN configuration. The Canadian Cyber Centre reports incidents in which malicious rogue peers were added to affected configurations, giving administrative access, persistence and long-term access.

What happened

On October 28, 2026 Talos published "Inside KeyDrift", an analysis of historical UAT-11473 activity on Cisco SD-WAN. The same day Cisco revised its advisory for CVE-2026-20127 to version 2.1 and added a pointer to the Talos post (labelled UAT-11473, KEYDRIFT). BleepingComputer covered the research on October 29.

According to Talos, KeyDrift is a set of components that work together:

  • PolyFlame (libdssl.so) is injected into vdaemon, the SD-WAN control process. It hooks socket, DTLS and dynamic-linker functions and provides a TinyShell-style backdoor, plus the ability to act as an intermediate command-and-control hop. BleepingComputer adds that it supports file upload and download and relays traffic between the attacker's server and peers.
  • rsshd is a ptrace-based injector that loads PolyFlame into vdaemon by process ID, and conf_sshd and trojanized runit launchers find the vdaemon PIDs and start the chain.
  • A packed aaamgrd loader uses anti-debugging checks and an RC4-encrypted embedded payload, and tampers with PAM configuration on a vBond appliance.
  • LittleFilch (libcommon.so) hooks SSL_read in vSmart to read control-session messages after decryption, extracts session identifiers and what Talos assesses to be data-plane key material, and stores them RSA-encrypted. BleepingComputer reports the data is written to /var/tmp/vdaemon.bin and sent out over UDP.
  • An endpoint file, vdaemon.conf, was deleted after being read, and Talos could not recover it.

Talos says it assesses with high confidence that KeyDrift is meant for long-term persistent access and automated exfiltration of keying material, and BleepingComputer reports signs of continuing development, including new anti-debugging and varied process impersonation.

Background

Cisco first published the CVE-2026-20127 advisory on February 25, 2026, rating it CVSS 10.0. It described an authentication bypass in the control-plane components that let a remote attacker act as a privileged internal account. The Canadian Cyber Centre issued its own alert the same day, saying it was aware of active exploitation and of rogue peers being added to SD-WAN deployments.

Earlier this week we covered Lumen's "Silent Train" report, which linked a relay network associated with Volt Typhoon to exploitation of Cisco SD-WAN. The Talos analysis arrives from a different direction: where Lumen looked at the attacker's network, Talos took apart the malware left on the victim's controllers, and its own high-confidence infrastructure overlap with Silent Train ties the two together.

BleepingComputer says the flaw was exploited as a zero-day since at least 2023 and mentions a second actor name, UAT-8616. We did not find either claim in the Talos post or the Cisco advisory we read, so we treat both as the outlet's reporting rather than something we have confirmed.

How it works

SD-WAN controllers sit in the middle of a company's wide-area network. They authenticate edge routers, distribute routing and policy over a control-plane session, and manage the keys that edge devices use to encrypt traffic between sites. That makes the controller a high-value target. Compromising it can mean reading how a network is laid out, adding a rogue device as a trusted peer, and, if the keys are taken, decrypting captured traffic.

KeyDrift follows that logic. Rather than stealing documents, it lives where decrypted control messages pass and picks out the identifiers and key material it needs. Running inside vdaemon helps it blend into normal process lists, and a deleted configuration file gives investigators less to work with. Because it lives on a controller and is not a flaw in the encryption itself, rotating compromised keys and rebuilding the affected controller from a clean image are the usual responses, which is why Cisco tells suspected victims to gather admin-tech data and involve TAC.

What it means

For network teams. Patching closes the door but does not evict an intruder who got in before February. Treat any controller that was reachable from the internet before patching as a candidate for compromise review, and use the log and file checks above.

For security leaders. The affected sectors named by Talos (space, satellite, defense, aerospace, policy research) are the ones usually on a state actor's list, but the exposure is any organization running these controllers. The attribution to a Volt Typhoon-linked network comes from infrastructure overlap, and Talos does not detail its evidence in the post we read.

For the industry. Networking control planes keep appearing in intrusion reports. The lesson, again, is to limit management ports such as 22 and 830 to known hosts and to assume that an internet-facing controller will be probed.

What we don't know yet

  • How many organizations were affected, and whether keys were actually exfiltrated from any network. Talos does not say.
  • The timeline of UAT-11473 activity: the Talos post gives no dates beyond its publication, and the "since 2023" claim is unconfirmed.
  • Whether UAT-11473 and UAT-8616 are the same operation.
  • A full set of indicators: no IPs, domains or hashes were published.
  • The contents of vdaemon.conf, which Talos could not recover.

What to watch next

  • Any update to Cisco's advisory or the Talos post with indicators or victim counts.
  • Government alerts from CISA, the Canadian Cyber Centre or other agencies tying UAT-11473 to named campaigns.
  • Public exploit code: search results we saw mention a public proof of concept and a Metasploit module, but we did not verify these.

Sources

SaveStart the discussion

Written by

audiotale.net team

The official account of the people who run audiotale.net: announcements, conversation starters and the newsroom's drafts. Posts written with AI say so. Every other account here is a real person.

Read next