UAT-11473 exploited Cisco SD-WAN flaw to deploy KeyDrift

Cisco Talos disclosed on Oct. 28, 2026, that UAT-11473, a highly sophisticated advanced persistent threat actor, exploited an authentication bypass flaw in Cisco SD-WAN Catalyst Controller instances to enter affected systems without authorization and install the KeyDrift malware framework.

Cisco Catalyst SD-WAN is a software-defined networking platform linking branch offices, data centers, and clouds through centrally managed controllers that route site traffic over encrypted links. The flaw carries a rating of 10 on the CVSS vulnerability scoring scale and is an authentication bypass issue: specially crafted requests let attackers sign in to controllers as privileged non-root internal users. The bug exists because a system’s peering authentication mechanism fails to work properly, and successful exploitation grants access to NETCONF so an attacker can change SD-WAN fabric settings. The flaw hits Cisco Catalyst SD-WAN Controller, once called vSmart, and Cisco Catalyst SD-WAN Manager, once called vManage, in on-premise and SD-WAN Cloud setups; the company said the Australian Signals Directorate’s Australian Cyber Security Centre reported the vulnerability.

Cisco said no workaround fully fixes CVE-2026-20127 and that moving to a fixed release is the only complete remedy. The company disclosed another Catalyst SD-WAN flaw in late February, CVE-2026-20129, rated 9.8 out of 10 on CVSS and able to let an unauthenticated remote attacker enter as a netadmin.

Cisco Talos reported that once inside, UAT-11473 deployed KeyDrift, a custom framework built to collect sensitive keying data, act as backdoors, and serve as relay points for command-and-control traffic. PolyFlame is the primary KeyDrift component. It resides in memory, arrives through changed runit service paths, and is injected into legitimate running vdaemon processes. For sshd deployment, the actor edits the service run script, makes /rootfs.rw executable, starts the malicious conf_sshd script in the background, and launches the legitimate sshd service; the conf_sshd loader lists process IDs for running vdaemon instances in /tmp/system-vdaemon, calls injector rsshd, and injects PolyFlame, carried as libdssl.so, into each one.

Talos said PolyFlame gains visibility into socket, DTLS (datagram transport layer security), and runtime-linker activity by interposing functions such as recvfrom, sendto, getpeername, dlopen, dlsym, and mprotect, and by parsing /proc/%d/maps. Because PolyFlame runs chiefly inside vdaemon, it reaches DTLS session keys, vEdge topology, Overlay Management Protocol routes, and policy tables. According to Talos, the samples contain no fixed IPv4 addresses, binding ports, callback domains, URLs, host headers, or polling intervals, and the implant gets its orders through the SD-WAN control channel instead of a regular external beacon.

Talos said PolyFlame intercepts recvfrom within vdaemon, executes the genuine recvfrom first to record the command-and-control address, then halts unless the MD5 hash of the local date matches a server-provided value. In admin mode, the implant reads a command code from the server: command code one emits random bytes as a probable check-in beacon, command code two chooses whether the implant acts as a TinyShell-style backdoor or an intermediate command-and-control node, and command code three installs the handler that manages commands for the intermediate command-and-control role.

Talos said the backdoor executes commands through “/bin/sh -c <command>”, writes files to disk, pulls files from disk, and sends them to the server, but offers no interactive shell. As an intermediate node, PolyFlame talks to one command-and-control server while serving many peers. Available commands include contacting a peer IP address, forwarding command-and-control data to a peer, removing a peer, returning a peer response to the server, and altering a memory value.

Talos said a separate PolyFlame variant pretends to be the aaamgr service, running from a malicious runit service at /etc/sv/aaamgr/. The aaamgrd file is a statically linked ELF64 executable with no section headers, one read-write-execute loader segment, and an RC4-protected embedded ELF payload. Its loader makes direct system calls including ptrace, fork, wait4, kill, tgkill, mmap, and mprotect, and it exits when its anti-debug check of /proc/%d/status and TracerPid finds a tracer. Investigators saw signs of timestomping along with the implant staging steps.

Talos said LittleFilch, another KeyDrift component, hooks SSL_read inside vdaemon and reviews decrypted control-plane buffers to pull keying material for a set list of edge nodes. It handles returned buffers only when size exceeds 0x18F, the first decrypted byte equals 0x07, and three marker patterns exist. The component scrambles keying material using RSA, saves it to /var/tmp/vdaemon.bin, and may send the encrypted content over UDP using DTLS 1.2 application-data records. LittleFilch reads /var/tmp/vdaemon.conf after it lists two host-port lines—one for a local bind address and port, and one for a remote destination address and port—then deletes the file once read; Talos never recovered it.

Talos rates its confidence as high that KeyDrift delivers sustained long-term access and the automated removal of sensitive keying material from within Cisco SD-WAN controller environments. The framework runs inside SD-WAN control-plane processes and intercepts decrypted control traffic, pulls metadata from control sessions along with keying material for the data plane, then stages or sends the material through encrypted records. Talos rates its confidence as high that KeyDrift targets collection inside the Cisco SD-WAN control plane by maintaining a sustained presence on the controller, reaching traffic inside the band, extracting keying material from decrypted control messages, and using encrypted staging or exfiltration. According to Talos, changes across KeyDrift modules and their deployment show the framework is still under development.

The actor’s observed targeting spans space and satellite services, defense and aerospace technology, and policy research. With high confidence, Talos says the actor’s infrastructure overlaps with the Silent Train covert access network tied to Volt Typhoon. Talos advised administrators to hunt for unauthorized Overlay Management Protocol peering sessions between controllers as a sign of compromise. Unauthorized peer links may appear ordinary but happen at odd times, come from unknown IP addresses, or use device types that do not match the environment’s design.

In late February 2026, Cisco Talos warned that UAT-8616 had begun exploiting CVE-2026-20127 in Cisco Catalyst SD-WAN Controller as far back as 2023. Investigators saw UAT-8616 activity confined to SD-WAN components, with no lateral movement beyond those systems and no command-and-control malware present. Talos said UAT-8616’s activity shows threat actors keep aiming at network edge devices to gain lasting footholds in important organizations, including critical infrastructure. “Nation state-sponsored actors, including Salt Typhoon and Volt Typhoon, have been known for past exploitation of Cisco devices,” said Scott Caveza, senior staff research engineer at Tenable.

CISA’s Emergency Directive 26-03, published Feb. 25, 2026, ordered Federal Civilian Executive Branch agencies to take inventory of Cisco SD-WAN systems, collect forensic artifacts, keep logs outside the systems, install updates, and investigate compromises tied to CVE-2026-20127 and CVE-2022-20775. CISA set a patch deadline of 5:00 PM ET on Feb. 27, 2026, for federal civilian agencies and called the exploitation an imminent threat to federal networks. Per CISA’s hunt and hardening guidance, agencies should rebuild from scratch rather than cleaning the current setup when attackers compromise a root account. “the ease with which these vulnerabilities can be exploited demands immediate action from all federal agencies,” said Madhu Gottumukkala, CISA acting director.

After gaining initial access, attackers rolled back the controller software to an older vulnerable version and leveraged CVE-2022-20775, a command-line path traversal flaw, to escalate privileges. Intelligence partners judged that the actor likely gained root via a version downgrade, used CVE-2022-20775, and then restored the original software to gain root access while concealing the intrusion. A rogue peer addition lets an attacker put a seemingly legitimate malicious device into the SD-WAN, open encrypted connections from it, and advertise networks under the attacker’s control.

Signs of compromise include rogue peering events, unusual logins, fraudulent user accounts added or removed, unexpected root logins, unauthorized SSH keys, PermitRootLogin changes, small or missing logs, and controller rollbacks or restarts. “The largest spike in activity occurred on March 4, with attacks widely spread across various regions worldwide,” said Ryan Dewhurst, head of threat intelligence at watchtower. “Our new alert makes clear that organisations using Cisco Catalyst SD-WAN products should urgently investigate their exposure to network compromise,” said Ollie Whitehouse, NCSC CTO.

Cisco released fixes for CVE-2026-20127 along with hardening guidance for Cisco Catalyst SD-WAN installations, and Talos urges defenders to patch first and follow the guide. Talos tells organizations to monitor systems for indicators of post-compromise activity and to launch incident response immediately upon spotting unauthorized behavior. Talos said victims should open a case with the Cisco Technical Assistance Center to receive help when compromise indicators appear.

The Snort rules 65938 and 65958 detect CVE-2026-20127 exploitation. The Snort version 2 rule set spanning 67387 through 67416 addresses the malicious samples. The Snort version 3 rule set spanning 7:44 through 7:73 addresses the malicious samples.