Cisco Talos published an analysis on October 28, 2026, attributing historical exploitation of CVE-2026-20127 and the deployment of KeyDrift on Cisco Catalyst SD-WAN systems to UAT-11473. Talos says the malware inspected decrypted control traffic and collected a 32-byte field it assesses as AES-256 IPsec data-plane key material. It describes encrypted local staging and the capability to send records over UDP, but not a confirmed transmission of collected keys.
On this page
- What Talos reported about KeyDrift
- How PolyFlame and LittleFilch handle control traffic
- Affected roles and reported fixed releases
- Detection indicators and response
- What the infrastructure overlap says
What Talos reported about KeyDrift
CVE-2026-20127 is an authentication bypass in Cisco Catalyst SD-WAN peering authentication. The reported exploit path allows an unauthenticated remote attacker to access a Controller through a high-privilege internal account that is not root. That account can access NETCONF, a network configuration protocol, and manipulate the SD-WAN fabric.
The Hacker News reported that the affected roles are Controller, formerly vSmart; Manager, formerly vManage; and Validator, formerly vBond. The reported scope includes on-premises and Cisco-hosted deployments, regardless of configuration. The access described for a Controller should not be taken to mean that the same account path applies identically to every role.
Talos describes the UAT-11473 activity as historical but does not date it. The separate report of activity “at least” since 2023 concerns UAT-8616, not KeyDrift.
How PolyFlame and LittleFilch handle control traffic
Talos describes PolyFlame as a memory-resident module injected into the legitimate vdaemon process. It can provide command execution or act as an intermediate command-and-control relay.
LittleFilch hooks SSL_read in vdaemon, where it can inspect control-traffic buffers after decryption. Talos assesses a 32-byte field it extracts as AES-256 IPsec data-plane key material. LittleFilch encrypts collected records and stages them locally; the module can also send records over UDP. The reported capability to transmit is not a confirmed outcome for the collected keys.
Affected roles and reported fixed releases
The Hacker News reported the following first fixed releases by software train:
| Cisco SD-WAN release train | Reported first fixed release |
| Earlier than 20.9 | Migrate to a fixed release |
| 20.9 | 20.9.8.2 |
| 20.11 | 20.12.6.1 |
| 20.12 | 20.12.5.3 or 20.12.6.1 |
| 20.13, 20.14, 20.15 | 20.15.4.2 |
| 20.16, 20.18 | 20.18.2.1 |
Match the release to the software train in use: the reported fixes differ across trains. The Hacker News also reported that Cisco listed no workaround. For on-premises deployments, its account of Cisco’s interim guidance was to restrict ports 22 and 830 to known controller and system IP addresses. Those restrictions do not remove malware already present on a device.
Detection indicators and response
A reported sign of CVE exploitation is an entry in /var/log/auth.log reading Accepted publickey for vmanage-admin from an unknown IP address. Talos also identifies artifacts associated with KeyDrift, including conf_sshd, rsshd, aaamgrd, libdssl.so, libcommon.so, /tmp/system-vdaemon, /var/tmp/vdaemon.bin, /var/tmp/vdaemon.conf, and /etc/sv/aaamgr/.
Talos lists Snort rules 65938 and 65958 for CVE-2026-20127. Its KeyDrift-related rules are Snort 2 SIDs 67387–67416 and Snort 3 SIDs 7:44–7:73. The Hacker News reported that the Snort 2 rules are disabled by default in the paid Subscriber ruleset.
Talos advises administrators who find indicators to begin incident response and contact Cisco TAC. The Hacker News also reported Cisco guidance to collect request admin-tech output from each control component and check those files for bug CSCws52722.
What the infrastructure overlap says
Talos assesses that UAT-11473’s operating infrastructure overlaps considerably with Silent Train, a network Lumen associates with Volt Typhoon. That infrastructure overlap does not identify UAT-11473 as Volt Typhoon. Lumen separately reported Volt Typhoon exploitation of CVE-2026-20127 by late 2025 and after Cisco’s February 2026 disclosure; that account is separate from Talos’s KeyDrift attribution.
