Cisco Talos said a cluster it tracks as UAT-11473 exploited a critical Catalyst SD-WAN authentication bypass, CVE-2026-20127, to install custom malware named KeyDrift on systems that control an organization's SD-WAN fabric^1,2.

The company patched the flaw in February 2026^1,2. The Hacker News reported a CVSS score of 10.0 and said an unauthenticated remote attacker can gain administrative privileges on Controller, Manager and Validator nodes, including on-premises gear and Cisco-hosted SD-WAN cloud, Managed and FedRAMP environments¹.

Talos assessed with high confidence that KeyDrift is built for long-term access and automated collection of keying material, according to BleepingComputer². The Hacker News said Talos called the attacks historical and did not specify when they happened or whether any keys were transmitted¹.

In Cisco's SD-WAN design, edge routers send AES traffic keys to the Controller, which distributes them; a process named vdaemon handles those encrypted control connections¹. KeyDrift's LittleFilch component hooks decrypted control-plane messages inside vdaemon and, for a preset list of edge nodes, copies IP identifiers and a 32-byte field that Talos assesses as AES-256 IPsec data-plane key material^1,2.

LittleFilch RSA-encrypts what it collects^1,2. BleepingComputer said it writes the data to /var/tmp/vdaemon.bin and can send it over UDP². The Hacker News said Talos could not recover the settings file that listed the destination address¹.

A second module, PolyFlame, runs in memory inside legitimate vdaemon processes after modified service startup scripts and an injector^1,2. It can run commands, move files and relay traffic between a command server and other peers, with no hardcoded server address in analyzed samples^1,2.

Talos said the operators targeted space and satellite services, defense and aerospace technology, and policy research organizations^1,2. BleepingComputer labeled UAT-11473 a newly identified APT². When Cisco disclosed the flaw in February, Talos had tracked exploitation under a different cluster, UAT-8616, dating to at least 2023^1,2.

Separately, Lumen said Volt Typhoon exploited CVE-2026-20127 by late 2025 and after Cisco's February disclosure; The Hacker News said Lumen did not tie that activity to KeyDrift¹. BleepingComputer noted other research linking exploitation of the same bug to Volt Typhoon and to Lumen's Silent Train framework reporting².

Cisco recommends applying the CVE-2026-20127 updates and its Catalyst SD-WAN hardening guidance². The Hacker News listed host indicators including modified sshd run scripts, a fake aaamgr service on Validators, and files such as conf_sshd, rsshd, libdssl.so and libcommon.so, plus Talos Snort rules published Oct. 28¹.