Cisco SD-WAN flaw enabled deployment of KeyDrift malware
The Cisco SD-WAN flaw tracked as CVE-2026-20127 was exploited to install custom malware inside systems that control an organization’s software-defined wide area network, or SD-WAN. Cisco Talos calls the malware KeyDrift and says it is designed to collect the encryption material protecting traffic between sites. Cisco fixed the vulnerability in February, but says it is aware of limited exploitation.
CVE-2026-20127 has a maximum Common Vulnerability Scoring System (CVSS) severity score of 10.0. An attacker who can reach an affected system does not need an existing account to bypass authentication and obtain administrative privileges. On a Catalyst SD-WAN Controller, formerly called vSmart, the attacker can sign in through a highly privileged internal account, although that account is not root, the operating system’s most powerful account. Talos tracked the earlier exploitation activity as UAT-8616 and said it dated back to at least 2023.
Cisco’s traditional traffic protection process has each SD-WAN router periodically generate an Advanced Encryption Standard (AES) key and send it to the Controller. The Controller distributes that information to other routers through encrypted control connections handled by a process called vdaemon. On a compromised Controller, a KeyDrift component named LittleFilch attaches itself to vdaemon and reads messages after the process has decrypted them. For a configured list of edge routers, it records their IP addresses and a 32-byte field that Talos assesses to be AES-256 traffic encryption material.
LittleFilch protects the collected records with RSA encryption and saves them in /var/tmp/vdaemon.bin. It can transmit the records through User Datagram Protocol (UDP) to an address held in /var/tmp/vdaemon.conf, which it deletes after reading. Talos did not recover that settings file. It describes the attacks as historical but did not establish when they happened or whether any collected material was successfully transmitted.
Talos tracks the operators behind KeyDrift as UAT-11473 and says they have targeted space and satellite services, defense and aerospace technology, and policy research. The researchers assess with high confidence that the group’s infrastructure overlaps considerably with Silent Train, the name Lumen’s Black Lotus Labs uses for a network of compromised small-office, home-office, Internet of Things and business devices. Lumen has associated that network with Volt Typhoon. Talos links UAT-11473 to Volt Typhoon only through the infrastructure overlap and does not claim they are the same group. It also does not explain the relationship between UAT-11473 and UAT-8616. Separately, Lumen said on October 28 that Volt Typhoon had exploited CVE-2026-20127 by late 2025 and continued after the February disclosure, but Lumen did not connect that activity to KeyDrift.
KeyDrift commonly starts through altered runit scripts, which are files used to launch services on the affected devices. In one version, the SSH service script starts conf_sshd before the legitimate remote-access server. That script records the process IDs for vdaemon in /tmp/system-vdaemon, after which a tool called rsshd injects the main PolyFlame module, stored as libdssl.so, into those running processes. PolyFlame operates in memory and can provide a TinyShell-like backdoor for executing commands and reading or changing files. It can also relay commands between its controlling system and other machines. Commands can arrive inside SD-WAN control traffic, and the examined samples did not contain a fixed command-server address.
On a compromised Catalyst SD-WAN Validator, formerly vBond, the attackers created a false aaamgr service under /etc/sv/aaamgr/. Its packed aaamgrd loader decrypts and starts PolyFlame. Cisco’s legitimate aaamgr component is a Python package and does not normally run as a compiled service. Talos also found evidence of timestomping, a concealment technique in which attackers copy the dates and permissions of legitimate files onto malicious ones. Other indicators include a modified run script under etc/sv/sshd/, conf_sshd, rsshd, libcommon.so, /var/tmp/vdaemon.bin and the deleted /var/tmp/vdaemon.conf. Talos did not publish KeyDrift file hashes, IP addresses or domains.
The vulnerability affects Catalyst SD-WAN Controller, Manager (formerly vManage) and Validator systems regardless of configuration. Both on-premises installations and Cisco-hosted deployments are affected, including Cisco Managed and FedRAMP environments. Cisco added the Validator to its advisory on June 16. The first fixed releases are 20.9.8.2 for the 20.9 train; 20.12.6.1 for 20.11; 20.12.5.3 or 20.12.6.1 for 20.12; 20.15.4.2 for 20.13, 20.14 and 20.15; and 20.18.2.1 for 20.16 and 20.18. Systems earlier than 20.9 must migrate to a fixed release. Releases earlier than 20.9 and the 20.11, 20.13, 20.14 and 20.16 trains are beyond software maintenance.
There is no workaround. Until an upgrade is possible, on-premises customers can restrict ports 22 and 830 to known controllers and other approved systems. Cisco says this worked in its test environment but advises customers to verify the result in their own networks. Similar restrictions are already applied to its hosted SD-WAN deployments. Port blocking does not remove malware from a system that is already compromised, and neither Talos’s guidance nor the upgrade instructions establish that installing a fixed release removes KeyDrift. Cisco’s February remediation guidance warns that malicious components placed before an upgrade may remain.
Administrators can search /var/log/auth.log for Accepted publickey for vmanage-admin records originating from unfamiliar IP addresses. Cisco recommends running request admin-tech on every control component before opening a Technical Assistance Center case, then rescanning the resulting files with Check Bug Applicability on the Bug Search Tool page for CSCws52722. Talos released Snort network-detection rules 67387 through 67416 for Snort 2 and 7:44 through 7:73 for Snort 3 on October 28. The Snort 2 rules are disabled by default in the paid Subscriber set and must be enabled manually. Existing rules 65938 and 65958 cover exploitation of CVE-2026-20127 itself.
Organizations that find evidence of compromise should begin incident response rather than treating an upgrade as proof that the system is clean. The US Cybersecurity and Infrastructure Security Agency’s February 25 emergency directive requires federal civilian agencies that identify root account compromise to report it, deploy new Manager, Controller and Validator instances from patched images, and transfer edge routers to those systems. For businesses seeking outside support with this type of infrastructure risk, AEU-I provides security-first IT, infrastructure and consulting.
Also available in: Shqip