The critical vulnerability CVE-2026-20127 (CVSS 10.0) in the management components of Cisco Catalyst SD-WAN has been used to install the specialized malware KeyDrift, designed to intercept encryption keys for inter-site traffic. According to Cisco Talos, which published its findings on October 28, the attacks have affected organizations in the space and satellite services sector, defense and aerospace technologies, as well as political research. The vulnerability enables an unauthenticated remote attacker to bypass authentication and obtain administrative privileges on SD-WAN controllers, managers and validators — all three key components of the control plane. Organizations using Cisco SD-WAN need not only to apply the patch, but also to investigate for signs of compromise: Cisco distinguishes between recovery procedures for “clean” systems and systems with signs of intrusion. We have previously written about the exploitation of this vulnerability.
Vulnerability: maximum severity
According to the Cisco advisory, CVE-2026-20127 is classified as CWE-287 (authentication bypass) with the maximum CVSS score of 10.0. The vulnerability allows a remote, unauthenticated attacker to bypass the peering authentication mechanism, gain administrative privileges and, via NETCONF, manipulate the configuration of the SD-WAN fabric. The attacker logs in using a highly privileged internal account that is not root.
All three management components are affected, regardless of configuration:
- Cisco Catalyst SD-WAN Controller (formerly vSmart)
- Cisco Catalyst SD-WAN Manager (formerly vManage)
- Cisco Catalyst SD-WAN Validator (formerly vBond)
The exposure perimeter is broader than it may seem at first glance: not only on-premises deployments are affected, but also cloud environments Cisco Hosted SD-WAN Cloud, Cisco Managed and FedRAMP. The vulnerability has been added to the CISA Known Exploited Vulnerabilities catalog with an entry date of February 25, 2026. There is no workaround.
Fixed software versions: 20.9.8.2 (for 20.9 and earlier), 20.12.5.3 (for 20.12), 20.15.4.2 (for 20.13–20.15) and 20.18.2.1 (for 20.16 and 20.18). Branches 20.11, 20.13, 20.14 and 20.16 have reached end of support — they require migration to a supported version.
KeyDrift: key interception architecture
According to Talos, the KeyDrift malicious framework operates inside SD-WAN control-plane processes and consists of two main components.
PolyFlame is a resident module that runs in the memory of the vdaemon process (this process services encrypted control connections between controllers and routers). PolyFlame functions as a backdoor with capabilities similar to TinyShell: command execution, file read and write, and relaying commands between the command server and other machines. According to Talos, the analyzed samples did not contain hardcoded command-and-control server addresses — commands are received inside SD-WAN control traffic.
LittleFilch is a component that, according to Talos, hooks SSL_read calls inside vdaemon and extracts a 32-byte field from decrypted control messages. Talos assesses this field as AES-256 key material that the controller passes between routers via the OMP protocol. The collected data is encrypted with RSA and written to the file /var/tmp/vdaemon.bin, after which it can be sent via UDP to an address from a configuration file. Talos was unable to recover this configuration file, so there is no independent confirmation of successful key exfiltration.
Persistence in the system is achieved by modifying runit scripts. On a compromised controller, the SSH service startup script calls the loader conf_sshd, which writes vdaemon process IDs, and the injector rsshd injects PolyFlame into each of them. On a validator, a fake service /etc/sv/aaamgr/ is created with a compiled loader aaamgrd — whereas the legitimate aaamgr component is a Python package. The attackers also used file timestamp spoofing for camouflage.
Attribution: two activity clusters
Talos tracks the operators of KeyDrift as UAT-11473 and assesses with high confidence that their infrastructure “significantly overlaps” with the Silent Train network — the name Lumen Black Lotus Labs uses for a network of compromised SOHO devices and IoT equipment. According to Lumen and previously CISA, NSA and the FBI, the Silent Train network was used by the Volt Typhoon group, which U.S. intelligence agencies have identified as a Chinese state-backed cyber group.
However, it is important to distinguish between two activity clusters. Talos links UAT-11473 to Volt Typhoon solely through overlapping infrastructure — without asserting that they are the same group. Separately, Lumen reports that Volt Typhoon has been exploiting CVE-2026-20127 since late 2025 and continued after the vulnerability was disclosed in February, but does not associate this activity with KeyDrift. Thus, we are looking at two parallel exploitation streams of the same vulnerability, whose relationship remains unestablished.
Detection and response
Cisco and Talos provide several detection tools that should be used in combination:
- Authentication log review: search
/var/log/auth.logfor entriesAccepted publickey for vmanage-adminfrom unknown IP addresses - Diagnostics collection: run
request admin-techon each management component before contacting TAC - Snort rules: Talos has released rules to detect KeyDrift C2 connections — SIDs 67387–67416 (Snort 2) and 7:44–7:73 (Snort 3). The Snort 2 rules are disabled by default and require explicit activation. Rules 65938 and 65958 cover the CVE-2026-20127 vulnerability itself
- KeyDrift file indicators: modified
runscript in/etc/sv/sshd/, directory/etc/sv/aaamgr/, filesaaamgrd,conf_sshd,rsshd,libdssl.so(PolyFlame),libcommon.so(LittleFilch),/tmp/system-vdaemon,/var/tmp/vdaemon.bin,/var/tmp/vdaemon.conf
Talos has not published file hashes, IP addresses or domains associated with KeyDrift, which limits network-based detection capabilities.
Remediation recommendations
According to the Cisco recovery guide, the procedure varies depending on the presence of indicators of compromise. Systems without signs of intrusion can be upgraded to a fixed version. Systems where indicators are found require working with TAC/PSIRT — the upgrade alone does not remove an already installed KeyDrift instance, as the guide explicitly warns.
Before installing updates on on-premises systems, Cisco recommends restricting access to ports 22 and 830 to the IP addresses of known controllers only. This measure has been tested by Cisco in lab conditions, but its effectiveness in a specific environment must be verified independently. For cloud deployments, Cisco has already enforced such restrictions.
For U.S. federal civilian agencies, CISA Emergency Directive ED-26-03 is in effect: if the root account is found to be compromised, agencies must notify CISA, deploy fresh instances of Manager, Controller and Validator from patched images, and move edge routers over to the new systems.
CVE-2026-20127 is a case where applying an update alone is not enough. Organizations using Cisco Catalyst SD-WAN in any deployment configuration need to check for KeyDrift indicators, collect diagnostics using request admin-tech, activate Snort rules to detect C2 traffic, and, if signs of compromise are found, contact Cisco TAC for guided recovery instead of limiting themselves to installing the patch.
