Cisco Talos reported on 28 October 2026 that a highly sophisticated threat actor it tracks as UAT-11473 exploited a critical authentication bypass in Cisco Catalyst SD-WAN Controllers to plant a custom malware framework called KeyDrift. The flaw, tracked as CVE-2026-20127, carries the maximum CVSS score of 10.0 and allows an unauthenticated remote attacker to gain administrative privileges on the control systems managing an organisation's SD-WAN network.

Who was targeted and what remains unclear

KeyDrift is built to live inside those control systems rather than on ordinary endpoints. Its main module, PolyFlame, is injected into the controller's vdaemon process through modified runit service scripts, via a loader called conf_sshd and an injector called rsshd. A second component, LittleFilch, hooks into decrypted control traffic and pulls out a 32-byte field that Talos assesses to be AES-256 key material for a preset list of edge routers, then encrypts what it collects and stages it for exfiltration.

What operators should do now

Talos says observed targeting spans space and satellite services, defence and aerospace technology, and policy research. It assesses with high confidence that the group's operating infrastructure overlaps considerably with Volt Typhoon's Silent Train covert network, but it does not say the two groups are the same.

Talos calls the attacks historical and does not specify when they occurred or whether any stolen keys were actually sent. The report documents a capability and past intrusions, not a confirmed live exfiltration in every targeted network.

Cisco has released patches for CVE-2026-20127 and a hardening guide, and Talos urges operators to apply them and hunt for past compromise. Warning signs include modified service run scripts, a fake aaamgr service, and files named conf_sshd and rsshd.

Anyone finding such signs should start incident response and contact Cisco's Technical Assistance Center.

Sources: Cisco Talos and The Hacker News.