Cisco SD-WAN KeyDrift: hunt UAT-11473 after CVE-2026-20127

HUNT · Actively exploited (KEV). Last updated 29 October 2026. See the Alert Tracker

If you run Cisco Catalyst SD-WAN Controllers, Managers or Validators, read this with the Talos KeyDrift analysis open. Patching CVE-2026-20127 is necessary and not sufficient: if the controller was reachable while vulnerable, rotate IPsec and control-plane keying material.

What it is

CVE-2026-20127 (opens in a new tab) is a CVSS 10.0 Critical authentication bypass in Cisco Catalyst SD-WAN. CISA added it to KEV on 25 February 2026 (federal due date 27 February). On 28 October 2026, Cisco Talos published that cluster UAT-11473 used the flaw to deploy KeyDrift — two modules that steal IPsec keying material from the vdaemon process:

• PolyFlame (libdssl.so) — injected into vdaemon; TinyShell-style remote access and relay.
• LittleFilch (libcommon.so) — hooks SSL_read, stages RSA-encrypted key records to /var/tmp/vdaemon.bin (and a short-lived /var/tmp/vdaemon.conf).

FIRST EPSS (28 October): about 0.893 (99.8th percentile). Talos assesses with high confidence that UAT-11473 infrastructure overlaps Volt Typhoon’s Silent Train covert access network — see our explainer Volt Typhoon Silent Train relay framework.

Who is affected

Vulnerable product family: Cisco Catalyst SD-WAN Controller, Manager and Validator software before the first fixed releases below. First fixed per Cisco: 20.9.8.2, 20.12.5.3 or 20.12.6.1, 20.15.4.2, 20.18.2.1. EoSM trains (20.11, 20.14, 20.16) should migrate to a fixed release. Controllers that exposed management SSH/NETCONF (ports 22 / 830) to untrusted networks while on a vulnerable build are the priority for both patching and key rotation.

Controller hunt

On authorised controllers, look for persistence and staging that Talos documented:

1. Modified runit service paths — unexpected content or remounts tied to /etc/sv/sshd/run and /etc/sv/aaamgr/run, including remounting /rootfs.rw executable.
2. /var/tmp/vdaemon.bin (and deleted /var/tmp/vdaemon.conf) — LittleFilch staging of stolen key material.
3. Injected vdaemon and conf_sshd — conf_sshd left running; rsshd / libdssl.so injection into vdaemon PIDs; transient /tmp/system-vdaemon.
4. Auth log anomaly — Accepted publickey for vmanage-admin from an unexpected System IP (defang any IoC IPs from Talos before you paste them into tickets).

# Illustrative host checks (authorised maintenance window)
ls -la /etc/sv/sshd/run /etc/sv/aaamgr/run
ls -la /var/tmp/vdaemon.bin /var/tmp/vdaemon.conf 2>/dev/null
ps aux | egrep 'conf_sshd|rsshd|vdaemon'
grep -E 'Accepted publickey for vmanage-admin' /var/log/auth.log

Sigma rules, KQL and Splunk starting points for controller syslog / file telemetry are in Hunt Lab pack 2026-10-29-cisco-sdwan-keydrift (PR linked from PUBLISH.md once open).

Silent Train overlap

Treat the Silent Train overlap as context for prioritisation, not as a claim that every KeyDrift hit is Volt Typhoon. If you already hunted Silent Train after our earlier piece, revisit controller estates that were internet-reachable before the February KEV window closed.

What to do

1. Patch Controller, Manager and Validator to a first fixed release (or later).
2. Hunt the artefacts above; collect admin-tech and open a Cisco TAC case if anything matches.
3. Rotate keys if the controller was exposed while vulnerable or if hunt findings are positive — rebuild IPsec / control-plane trust; do not stop at the software upgrade.
4. Harden management-plane access (restrict ports 22 and 830 to known controller IPs) and follow Cisco’s Catalyst SD-WAN hardening guidance.

Sources

• Cisco Talos — UAT-11473 and KeyDrift (opens in a new tab) (28 October 2026)
• Cisco — Catalyst SD-WAN Controller Authentication Bypass Vulnerability (cisco-sa-sdwan-rpa-EHchtZk) (opens in a new tab)
• The Hacker News — Hackers exploited Cisco SD-WAN flaw (opens in a new tab)
• CISA KEV (opens in a new tab) (CVE-2026-20127 dateAdded 2026-02-25, dueDate 2026-02-27)
• Cyber-Threat.net — Volt Typhoon Silent Train relay framework

Follow Cyber-Threat.net RSS · Feedly (opens in a new tab) · X (opens in a new tab) · Bluesky (opens in a new tab) · LinkedIn (opens in a new tab)