Cisco Talos has identified historical exploitation of the critical Cisco Catalyst SD-WAN authentication-bypass flaw CVE-2026-20127 to install a malware framework called KeyDrift, according to Talos’s technical analysis. The framework’s LittleFilch component hooks the vdaemon process, reads decrypted control-plane messages and extracts what Talos assesses is AES-256 key material exchanged between SD-WAN routers.
Talos says KeyDrift also provides persistent backdoor and relay capabilities through its PolyFlame component, which can be injected into legitimate SD-WAN processes. The analysis found no hardcoded IP addresses, domains or URLs in the samples examined. Talos attributes the activity to UAT-11473 and assesses with high confidence that its infrastructure overlaps considerably with Volt Typhoon’s Silent Train network, but it does not say the two are the same group.
The flaw affects the Catalyst SD-WAN Controller, Manager and Validator, including on-premises systems and Cisco-hosted cloud deployments. The Hacker News reports that CVE-2026-20127 has a CVSS score of 10.0 and allows an unauthenticated remote attacker to bypass authentication and obtain administrative privileges. Cisco has said it is aware of limited exploitation, while Talos describes the KeyDrift activity as historical; neither source establishes when the intrusions occurred, how many systems were affected or whether any encryption keys were sent to attackers.
Cisco’s fixed releases, as reported by The Hacker News, include 20.9.8.2 for the 20.9 train, 20.12.5.3 or 20.12.6.1 for 20.12, 20.15.4.2 for 20.13 through 20.15, and 20.18.2.1 for 20.16 and 20.18. Releases earlier than 20.9 and the 20.11, 20.13, 20.14 and 20.16 trains are listed as having reached end of software maintenance. Cisco says there is no workaround; on-premises customers awaiting upgrades can restrict ports 22 and 830 to known systems, but that does not remove malware already present.
The reported response therefore involves both patching and compromise assessment. The Hacker News says Cisco’s remediation guidance warns that existing exploits may remain after an upgrade, while Talos recommends monitoring for post-compromise activity and using its newly released Snort detections for KeyDrift.