A severe vulnerability in Cisco’s Catalyst SD-WAN product was exploited by attackers to plant a stealthy malware named KeyDrift, designed to extract AES encryption keys used to protect traffic between SD-WAN routers. The vulnerability, identified as CVE-2026-20127 and rated at CVSS 10.0, allows unauthenticated remote attackers to ascend to administrative privileges on the SD-WAN control components. On compromised systems, the attackers can log in as high-privileged internal accounts. It was officially patched earlier this year, but signs indicate the flaw has been under active exploitation for months, at least since 2023.
How KeyDrift Works
In the typical operation of Cisco’s SD-WAN, individual routers generate AES keys and send them to the SD-WAN Controller (formerly known as vSmart), which in turn distributes them to other routers. The component vDaemon on the Controller handles the encrypted control connections carrying these keys. Once the Controller is compromised, KeyDrift’s module LittleFilch hooks into vDaemon, intercepting decrypted control messages. It extracts key-related data—specifically a 32-byte field tied to edge routers—and encrypts the stolen material with RSA before saving it. Further, it can exfiltrate this data over UDP and cleanse evidence via deletion of its settings files.
Beyond LittleFilch, KeyDrift includes a backdoor component called PolyFlame. Installed via tampered service startup scripts (notably for SSH) and fake loader services on the Validator (formerly vBond), PolyFlame runs in memory inside vDaemon. It can execute commands, read/write files, or relay instructions disguised within legitimate control traffic. In addition, the malware uses timestomping techniques, copying timestamps and permissions from benign files to conceal its presence.
Affected Systems, Attribution, and Timeline
The vulnerability impacts all major control components of Cisco’s SD-WAN solution—Controller, Manager (formerly vManage), and Validator—across both on-premises and Cisco’s hosted or cloud-managed FedRAMP environments. Cisco added Validator to its advisory by mid-June. Exploitation of CVE-2026-20127 has been observed since at least late 2025, and the malware campaign (called UAT-11473) is believed to overlap with UAT-8616, another cluster tracked since early 2023.
The attack is linked indirectly to infrastructure associated with a threat actor known as Volt Typhoon—a Chinese state-affiliated group—though attribution is limited to overlapping tools and network paths. However, Talos, Cisco’s threat research arm, does not definitively say they are the same group.
Remediation, Detection & What to Do
Cisco has released fixes for the vulnerability across multiple release trains. For versions earlier than 20.9, users must upgrade to fixed releases such as 20.9.8.2. Other affected versions and their patched equivalents include 20.12.5.3, 20.15.4.2, 20.18.2.1, among others. Software versions prior to 20.9 and certain release trains like 20.11, 20.13, and 20.16 are officially out of maintenance.
Since there is no workaround that fully fixes the flaw short of applying the patches, Cisco advises restricting access to critical ports (22 and 830) to known controller IPs as a temporary mitigation. However, restricting ports doesn’t remove the malware if it is already installed. For detection, administrators should look for signs such as modifications in startup scripts like run (under etc/sv/sshd/), files such as aaamgrd, conf_sshd, rsshd, and shared libraries like libdssl.so and libcommon.so, among others. Cisco also supplies updated Snort rules to identify command-and-control traffic related to KeyDrift and monitor unauthorized public-key logins for `vmanage-admin` accounts from unfamiliar IPs.
For U.S. federal civilian agencies, there is an emergency directive: affected systems must be rebuilt using patched images and any edge routers connected to compromised Controllers, Validators, or Managers must be redirected to fresh instances. All root account compromises must be reported to the proper authorities.
