- What: Attackers exploited CVE-2026-20127 in Cisco Catalyst SD-WAN to plant KeyDrift, custom malware that runs inside the vdaemon process on SD-WAN control systems.
- Impact: On a compromised Controller, KeyDrift harvests what Talos assesses as AES-256 key material for selected edge routers, encrypts it and stores it, with the ability to send it out over UDP.
- Fix / mitigation: Cisco's first fixed releases include 20.9.8.2, 20.12.5.3, 20.12.6.1, 20.15.4.2 and 20.18.2.1, there is no workaround, and Cisco has not said in this advice whether upgrading removes KeyDrift.
- Who's at risk: Organizations running on-premises or Cisco-hosted Catalyst SD-WAN are affected by the flaw, and the group behind KeyDrift has targeted space and satellite services, defense and aerospace technology, and policy research.
Attackers exploited a CVSS 10.0 flaw in Cisco Catalyst SD-WAN to plant custom malware on the systems that control an organization's SD-WAN network. The malware, KeyDrift, is designed to copy the keys that encrypt traffic between sites and store them for later use. Cisco Talos disclosed it on October 28. Talos calls the attacks historical, but does not say when they occurred or whether any keys were sent.
The flaw, CVE-2026-20127, was fixed in February. That does not settle the matter for anyone who was exposed before upgrading. Cisco's February remediation guide warns that there could be "existing exploits which are still in place" from before an upgrade.
The Flaw: Unauthenticated Admin on the Control Plane
CVE-2026-20127 allows an unauthenticated remote attacker to bypass authentication and gain administrative privileges on SD-WAN control systems. On a Controller, the attacker can log in as a high-privileged internal account that is not root. The flaw affects the Catalyst SD-WAN Controller (formerly vSmart), Manager (formerly vManage) and Validator (formerly vBond), regardless of configuration.
Exposure extends beyond on-premises systems to Cisco's hosted SD-WAN cloud deployments, including the Cisco Managed and FedRAMP environments. Cisco added the Validator to its advisory on June 16 and says it is aware of limited exploitation.
How KeyDrift Takes the Keys
In Cisco's traditional key exchange, each SD-WAN router periodically generates an AES key for its traffic and sends it to the Controller, which passes it on to other routers. A Controller process called vdaemon runs the encrypted control connections that carry those keys. That design makes vdaemon the point where KeyDrift collects them.
A KeyDrift component called LittleFilch hooks into vdaemon and reads control messages after they are decrypted. For a preset list of edge routers, it pulls out their IP addresses and a 32-byte field that Talos assesses as the AES-256 key material passed between routers. LittleFilch encrypts what it collects with RSA and writes it to a file. It can then send that data over UDP to an address listed in a settings file, which it deletes after reading. Talos could not recover that settings file, so the destination remains unknown.
The preset router list shows selective collection, not bulk theft. Stolen keys are only useful against traffic encrypted with them, so an attacker would also need access to that traffic. The source reporting does not show that any traffic was captured or decrypted, but SD-WAN encryption cannot be assumed to have held for routers whose keys passed through a compromised Controller.
Loading, Backdoor and Anti-Forensics
KeyDrift primarily starts through modified runit scripts that Cisco SD-WAN devices use to launch their services. In one version, the SSH service script starts a loader script, conf_sshd, before the real SSH server. That script writes vdaemon's process IDs to a file, and a tool called rsshd injects KeyDrift's main module, PolyFlame, into each of those processes.
PolyFlame runs in memory inside vdaemon. It can act as a TinyShell-like backdoor that runs commands and reads and writes files, or as a relay that forwards commands between its command server and other machines. It is built to accept commands within SD-WAN control traffic, and the analyzed samples contained no hardcoded server address, so those samples yield no server address to block.
On a compromised Validator, a fake aaamgr service under /etc/sv/aaamgr/ runs a packed loader, aaamgrd, that decrypts and runs PolyFlame. Cisco's real aaamgr component is a Python package and does not normally run as a compiled service. Talos also found signs of timestomping: commands the group ran copied the timestamps and permissions of existing files onto its own files, which weakens file-date evidence during an investigation.
Attribution: An Overlap, Not an Identification
Talos tracks the group behind KeyDrift as UAT-11473. It has targeted space and satellite services, defense and aerospace technology, and policy research. Talos assesses with high confidence that the group's infrastructure "overlaps considerably" with Silent Train, the name Lumen's Black Lotus Labs uses for a network of hacked small-office, home-office, IoT and business devices.
Lumen says Volt Typhoon, which CISA, the NSA and the FBI described in 2024 as a Chinese state-sponsored group, used that network to hide its activity. Talos links UAT-11473 to Volt Typhoon only through the infrastructure overlap. It does not say the two are the same group, and it does not explain how UAT-11473 relates to UAT-8616, the cluster it reported in February with activity going back to at least 2023.
Separately, Lumen said on October 28 that Volt Typhoon was exploiting CVE-2026-20127 by late 2025 and continued after Cisco's February disclosure. Lumen does not tie that activity to KeyDrift.
Affected Releases and Vendor Fixes
There is no workaround. Cisco lists these first fixed releases:
- Earlier than 20.9: migrate to a fixed release
- 20.9: 20.9.8.2
- 20.11: 20.12.6.1
- 20.12: 20.12.5.3 or 20.12.6.1
- 20.13, 20.14 and 20.15: 20.15.4.2
- 20.16 and 20.18: 20.18.2.1
Releases earlier than 20.9 and the 20.11, 20.13, 20.14 and 20.16 trains have reached end of software maintenance, so those customers face a train migration rather than a point update. As an interim mitigation for on-premises customers, Cisco says access to ports 22 and 830 can be limited to the IP addresses of known controllers and other known systems. Cisco says this worked in a test environment, but that effectiveness should be validated in each network. Equivalent guardrails are already in place for its hosted deployments. Blocking the ports does not remove malware already on a device.
What Remains Unanswered
Talos advises installing Cisco's fixes, following the Catalyst SD-WAN hardening guide and watching for post-compromise activity, with incident response and Cisco TAC support if signs appear. That advice does not say whether upgrading removes KeyDrift from a compromised device, or whether any keys should be replaced.
Those gaps matter most to organizations that ran exposed control systems before patching. A completed upgrade establishes that the flaw is closed. It does not, on the published information, establish that a device is clean or that previously exchanged keys were never collected. The dates of the attacks, the number of victims and any confirmed key transfer are also undisclosed.
Published KeyDrift Indicators
Talos lists these files and locations, some given only by name:
- The run script under etc/sv/sshd/, modified to start conf_sshd
- /etc/sv/aaamgr/, a fake service directory on a compromised Validator
- aaamgrd, the packed loader
- conf_sshd, the loader script
- rsshd, the injector
- libdssl.so, PolyFlame
- libcommon.so, LittleFilch
- /tmp/system-vdaemon, a list of vdaemon processes
Because PolyFlame runs in memory and the group altered file timestamps, the absence of these names or of suspicious file dates is limited evidence on its own. For an organization with exposed Catalyst SD-WAN control systems, the open question is no longer only whether the February fix was applied, but what happened on those systems before it was.
Questions about your exposure?
RedEye Security provides assessments for organizations that need to understand their real risk.
Talk to us