KeyDrift Malware Exploits Cisco SD-WAN Flaw CVE-2026-20127

• •CVE-2026-20127 is a critical authentication bypass flaw in Cisco SD-WAN controllers.
• •KeyDrift malware targets encryption keys, enabling unauthorized access to sensitive data.
• •UAT-11473's infrastructure overlaps with the Chinese state-linked Volt Typhoon group.

Cisco Talos reported that the advanced persistent threat group UAT-11473 exploited a critical authentication bypass vulnerability (CVE-2026-20127) in Cisco SD-WAN Catalyst Controllers. This flaw, which has a CVSS score of 10.0, allows unauthorized remote access to administrative privileges. The group deployed a custom malware framework named KeyDrift, which is designed to collect sensitive encryption keys from control-plane traffic. The malware's components, PolyFlame and LittleFilch, enable persistent access and automated exfiltration of keying material. The attacks have targeted sectors including space and satellite services, defense, and policy research. Talos assesses with high confidence that UAT-11473's infrastructure overlaps with the Volt Typhoon's Silent Train network, although no direct link between the two groups has been established. The vulnerability was disclosed in February 2026, and exploitation has been linked to activities dating back to at least 2023.