In the brief for Thu, Oct 29

Attackers planted KeyDrift malware on Cisco SD-WAN controllers, Talos says

Oct 29, 7:00 a.m. ET

Affected: Cisco Catalyst SD-WAN Controller, Manager and Validator before the first fixed releases, regardless of configuration. All versions and fixes

Cisco Talos said on Oct 28 that a group it tracks as UAT-11473 exploited , an authentication bypass in Cisco Catalyst SD-WAN, and installed malware Talos calls KeyDrift. KeyDrift runs inside the controller’s own processes, where it gives the attackers a backdoor and a relay and extracts the keys that protect SD-WAN data-plane traffic. Talos says the targets were in space and satellite services, defense and aerospace, and policy research. Cisco disclosed the flaw on Feb 25, and CISA added it to KEV the same day.

KeyDrift’s main module, PolyFlame, is injected into the controller’s vdaemon processes through modified runit service scripts. It can run commands, read and write files, and relay commands between its command server and other peers. Another module, LittleFilch, hooks SSL_read in vdaemon, pulls key material for chosen edge devices from decrypted control traffic, and stages it in .

Talos assesses with high confidence that UAT-11473’s infrastructure overlaps considerably with Silent Train, which Lumen’s Black Lotus Labs, also on Oct 28, called Volt Typhoon’s covert access network. Lumen says Volt Typhoon was exploiting the same Cisco flaw by late 2025, and kept at it well after Cisco disclosed it.

Cisco updated its advisory on Oct 28 to link the Talos report. Cisco says it’s aware of limited exploitation and lists no workaround. Talos has published Snort rules for the flaw and for KeyDrift’s components.

CVE: In KEV since Feb 25, 2026: CVE-2026-20127
Vendor: Cisco

What to do

6 steps

1Upgrade Cisco Catalyst SD-WAN to the first fixed release in Cisco’s advisory for the release in use, moving off 20.11, 20.13, 20.14 and 20.16, which are past end of maintenance.
2Check /var/log/auth.log on controllers for “Accepted publickey for vmanage-admin” from addresses that aren’t among the System IPs in SD-WAN Manager, as Cisco advises.
3Look for the KeyDrift files Talos lists, such as and an binary under /etc/sv/aaamgr/, and changed runit scripts for sshd and aaamgr.
4Enable Snort rules 65938 and 65958 for the flaw, and Talos’s rules for KeyDrift: Snort 2 SIDs 67387 to 67416, or Snort 3 rules 7:44 to 7:73.
5If you find signs of compromise, open a case with Cisco’s Technical Assistance Center, as Cisco and Talos advise.
6Follow Cisco’s Catalyst SD-WAN hardening guide, and allow only known, trusted hosts to reach the control components.

Affected and fixed versions

Product	Affected	Fixed
Cisco Catalyst SD-WAN 20.9	Releases before the fixed one	The fixed `20.9` release in Cisco’s advisory
Cisco Catalyst SD-WAN 20.11	All releases, past end of software maintenance	The later of the two fixed `20.12` releases in Cisco’s advisory
Cisco Catalyst SD-WAN 20.12	Releases before the fixed ones	Either fixed `20.12` release in Cisco’s advisory
Cisco Catalyst SD-WAN 20.13 to 20.15	All `20.13` and `20.14` releases, and `20.15` before the fixed one	The fixed `20.15` release in Cisco’s advisory
Cisco Catalyst SD-WAN 20.16 and 20.18	All `20.16` releases, and `20.18` before the fixed one	The fixed `20.18` release in Cisco’s advisory
Cisco Catalyst SD-WAN before 20.9	All releases	Migrate to a fixed release

Product
Cisco Catalyst SD-WAN 20.9
Affected
Releases before the fixed one
Fixed
The fixed 20.9 release in Cisco’s advisory
Product
Cisco Catalyst SD-WAN 20.11
Affected
All releases, past end of software maintenance
Fixed
The later of the two fixed 20.12 releases in Cisco’s advisory
Product
Cisco Catalyst SD-WAN 20.12
Affected
Releases before the fixed ones
Fixed
Either fixed 20.12 release in Cisco’s advisory
Product
Cisco Catalyst SD-WAN 20.13 to 20.15
Affected
All 20.13 and 20.14 releases, and 20.15 before the fixed one
Fixed
The fixed 20.15 release in Cisco’s advisory
Product
Cisco Catalyst SD-WAN 20.16 and 20.18
Affected
All 20.16 releases, and 20.18 before the fixed one
Fixed
The fixed 20.18 release in Cisco’s advisory
Product
Cisco Catalyst SD-WAN before 20.9
Affected
All releases
Fixed
Migrate to a fixed release

Indicators

Type	Value	Note
File name		PolyFlame module injected into vdaemon
File name		Injector that loads PolyFlame into vdaemon
File name		Script that finds vdaemon processes for injection
File name		Packed PolyFlame loader under /etc/sv/aaamgr/
File name		LittleFilch module that hooks SSL_read in vdaemon
File name		LittleFilch’s encrypted staging file
File name		LittleFilch configuration, deleted after it’s read
File name		List of vdaemon process IDs the loader records

File namePolyFlame module injected into vdaemon
File nameInjector that loads PolyFlame into vdaemon
File nameScript that finds vdaemon processes for injection
File namePacked PolyFlame loader under /etc/sv/aaamgr/
File nameLittleFilch module that hooks SSL_read in vdaemon
File nameLittleFilch’s encrypted staging file
File nameLittleFilch configuration, deleted after it’s read
File nameList of vdaemon process IDs the loader records

Timeline

Feb 25Cisco discloses the flaw, and CISA adds it to KEV.
Oct 28Talos publishes its KeyDrift report, and Cisco links it from its advisory.
Oct 28Lumen publishes its report on Volt Typhoon’s Silent Train network.

Sources

Cisco Talos researchPrimary source blog.talosintelligence.com
Cisco advisoryPrimary source sec.cloudapps.cisco.com
Lumen researchPrimary source lumen.com