CVE-2026-20127 carries a CVSS score of 10.0 — the maximum severity rating — and, according to Cisco Talos, attackers used it to place custom malware inside the systems that control an organization’s SD-WAN network.
CVE-2026-20127: what the flaw allows and where it lives
The vulnerability tracked as CVE-2026-20127 permits an unauthenticated remote attacker to bypass authentication and gain administrative privileges on Cisco Catalyst SD‑WAN control components. Talos says an attacker who reaches a Controller can log in as a high‑privileged internal account that is not root. The flaw affects the Catalyst SD‑WAN Controller (formerly vSmart), Manager (formerly vManage) and Validator (formerly vBond), regardless of configuration, and impacts both on‑premises systems and Cisco's hosted SD‑WAN cloud deployments — including Cisco Managed and FedRAMP environments. Cisco added the Validator to its advisory on June 16.
KeyDrift: a custom malware family that steals encryption keys
Cisco Talos named the implanted malware KeyDrift and says it is designed to copy the AES keys used to encrypt traffic between SD‑WAN sites and store those keys for later use. Talos describes the attacks as historical but does not specify when they occurred or whether any keys were exfiltrated. KeyDrift includes multiple components: LittleFilch, which hooks into the Controller's vdaemon process to read decrypted control messages; PolyFlame, an in‑memory module that can act as a TinyShell‑like backdoor or as a command relay; and supporting loaders and injectors such as rsshd and aaamgrd.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadHow the malware operates inside SD‑WAN control planes
Cisco's normal key exchange has each SD‑WAN router periodically generate an AES key and send it to the Catalyst SD‑WAN Controller, which passes keys on to other routers; the control connections carrying those keys are handled by a process called vdaemon. On a compromised Controller, LittleFilch attaches to vdaemon and reads control messages after decryption. For a preset list of edge routers it extracts IP addresses and a 32‑byte field that Talos assesses as the AES‑256 key material the Controller passes between routers.
LittleFilch encrypts the captured material with RSA and writes it to a file. It can then send that data over UDP to an address stored in a settings file, which LittleFilch deletes after reading; Talos could not recover that settings file. PolyFlame is injected into vdaemon processes by an altered runit start script pattern: in one variant the SSH service run script launches a conf_sshd loader before the real SSH server, conf_sshd writes vdaemon PIDs to a file and rsshd injects PolyFlame into those processes. On Validators, a fake aaamgr service under /etc/sv/aaamgr/ runs the packed loader aaamgrd that decrypts and runs PolyFlame; Cisco's real aaamgr is a Python package and does not normally run as a compiled service.
Attribution and infrastructure: UAT‑11473, UAT‑8616, Silent Train and Volt Typhoon
Talos tracks the group that developed KeyDrift as UAT‑11473 and says it has targeted space and satellite services, defense and aerospace technology, and policy research. Talos assesses with high confidence that that group's infrastructure “overlaps considerably” with Silent Train — the name Lumen's Black Lotus Labs uses for a network of hacked SOHO, IoT and business devices. Lumen has said Volt Typhoon used the Silent Train network to hide activity; Lumen also reported that Volt Typhoon was exploiting CVE‑2026‑20127 by late 2025 and continued exploiting it after Cisco disclosed the flaw in February. CISA, the NSA and the FBI said in 2024 that Volt Typhoon is a Chinese state‑sponsored cyber group. Talos links UAT‑11473 to Volt Typhoon only through the infrastructure overlap and does not state the two are the same group, nor does it specify how UAT‑11473 relates to UAT‑8616, the exploitation cluster Talos reported in February.
Cisco, detection steps and federal reporting requirements
Cisco disclosed the flaw and issued fixes in February; it says it is aware of limited exploitation. There is no workaround, and Cisco notes releases earlier than 20.9 and the 20.11, 20.13, 20.14 and 20.16 trains have reached end of software maintenance. Until they can upgrade, on‑premises customers can limit access to TCP ports 22 and 830 to the IP addresses of known controllers and other trusted systems — a step Cisco says worked in test environments but which customers should validate in their own networks. Cisco warns blocking ports does not remove malware already present on a device.
Talos recommends installing Cisco's fixes, following the Catalyst SD‑WAN hardening guide and monitoring for post‑compromise activity; organizations that find signs should begin incident response and may ask Cisco TAC for assistance. To check for exploitation of the flaw, Cisco advises looking in /var/log/auth.log for “Accepted publickey for vmanage‑admin” entries from unknown IP addresses and running request admin‑tech on each control component before opening a TAC case. Talos released Snort signatures for KeyDrift command‑and‑control (Snort 2 rules 67387–67416 and Snort 3 rules 7:44–7:73); existing Snort rules 65938 and 65958 cover CVE‑2026‑20127 itself. The October 28 Snort update lists the Snort 2 KeyDrift rules as disabled by default for paid subscribers; Snort 3 rules appear with no default state.
For US federal civilian agencies, CISA's February 25 emergency directive mandates reporting root‑account compromises to CISA, deploying fresh Manager, Controller and Validator instances from patched images, and moving edge routers to the new systems.
Talos's findings make plain a technical consequence that matters: when control‑plane hosts are compromised, the keys that protect site‑to‑site traffic can be read where they are supposed to be safest. That leaves administrators with two immediate tasks Cisco and Talos have described clearly — install patched images where available, and hunt for signs that KeyDrift or other implants remain on systems that were reachable before the fixes.
