Is your Cisco SD-WAN compromised? What KeyDrift looks for

Talos says CVSS 10 flaw fixed in February let UAT-11473 plant key-stealing malware on SD-WAN controllers

A flaw rated 10 out of 10 and fixed in February was used to plant malware that copies the keys encrypting traffic between your sites. Cisco Talos described the malware, called KeyDrift, on October 28. It calls the attacks historical but doesn't say when they happened or whether any keys were sent out.

However, the vulnerability known as CVE-2026-20127 enables an attacker without authentication credentials to break through the authentication process and obtain administrative privileges on Cisco Catalyst SD-WAN control systems.

Key Drift and SD-WAN encryption keys

Once the controller is successfully breached, the KeyDrift component LittleFilch attaches itself to the vdaemon process and starts reading the control messages once they get decrypted. It extracts from those messages IP addresses of edge routers and a 32-byte chunk of data that appears to be an AES-256 key, according to Talos researchers.

The collected data gets encrypted by LittleFilch and saved to a file. It is capable of sending the collected information via UDP to an address listed in the settings file; however, Talos was unable to recover it. The PolyFlame module operates in-memory as a backdoor/relay.

Talos tracks the group as UAT-11473. It has targeted space and satellite services, defence and aerospace technology, and policy research.

Its infrastructure overlaps considerably with Silent Train, a network of hacked devices that Lumen says Volt Typhoon used. Talos links the two only through that overlap. It doesn't say they're the same group.

Separately, Lumen said Volt Typhoon was exploiting the flaw by late 2025. Lumen doesn't tie that activity to KeyDrift.

How to patch CVE-2026-20127?

This defect is applicable to the Controller, Manager, and Validator both on-premises and in Cisco’s cloud-hosted instance. Cisco states that a workaround isn't available. The first fixes are released as 20.9.8.2 in the 20.9 line, 20.12.6.1 in 20.11 and 20.12, 20.15.4.2 in 20.13 to 20.15, and 20.18.2.1 in the 20.16 and 20.18 lines. Versions prior to 20.9 need migration.

Until the upgrade, restrict ports 22 and 830 to known controller IP addresses. This does not address malware that may already be resident on the device.

Review any changed SSH execution scripts, a spoofed aaamgr process on a validator, libdssl.so, or libcommon. so and /var/tmp/vdaemon.bin. for “Accepted public key for vmanage-admin” in /var/log/auth.log from unknown IP addresses. Snort rules have been published by Talos on Wednesday.

Meta loses French court appeal in antitrust dispute over press publisher compensation

Telegram call flaw hit Android versions from 2022 to 2026

Trump Mobile T1 teardown uncovers two-year-old HTC phone inside

Nvidia faces DOJ antitrust scrutiny over proposed Hugging Face open-source deal: What to know

WhatsApp to bring payments to more countries

Google unveils Gemini 4 Carbon AI model with record-breaking cybersecurity capabilities

You can now text your ChatGPT Dot: 3 things to know

Elon Musk called a genius by Putin as Russia rolls out Starlink rival

Apple set to break longstanding taboo with first touchscreen MacBooks

3 things depot wants from AI shopping agents

China could surpass US in AI by 2030: 8 industries at stake

Mark Cuban's $6M sale taught him one rule time