---
schema: 1
kind: threat
title: "KeyDrift: Talos reports UAT-11473 exploiting CVE-2026-20127 in Cisco Catalyst SD-WAN controllers to run an implant inside the control-plane daemon that collects data-plane keys, with infrastructure overlapping Volt Typhoon's Silent Train network"
headline: "Talos: UAT-11473 implants KeyDrift in Cisco SD-WAN controllers through CVE-2026-20127 to collect data-plane keys"
summary: >
  Cisco Talos reports that a cluster it calls UAT-11473 exploited CVE-2026-20127, the peering authentication bypass in Cisco Catalyst SD-WAN
  Controller, Manager and Validator (CVSS 10.0, fixed releases since February 2026, no workaround), and then ran the KeyDrift implant inside
  the controller's control-plane process to collect session metadata and what Talos assesses to be data-plane IPsec keys. Cisco's
  advisory, revised on 2026-10-28 to link Talos's post, says it is aware of limited exploitation, and Talos assesses with high confidence that the operating
  infrastructure overlaps considerably with Volt Typhoon's Silent Train network.
discovered_at: "2026-10-29T04:40:00Z"
updated_at: null
event_date: "2026-10-28"
run_id: 2026-10-29T0255Z-intel
priority: high
immediate_action: null
tags: [nation-state, espionage, vulnerabilities, auth-bypass, pre-auth, actively-exploited, cisa-kev, patch-available]
regions: [global]
sectors: [defense, technology]
entities: ["actor:uat-11473", "malware:keydrift", "actor:volt-typhoon", "product:cisco-catalyst-sd-wan-controller", "product:cisco-catalyst-sd-wan-manager", "product:cisco-catalyst-sd-wan-validator"]
techniques: [T1190, T1055.008, T1574.006, T1037, T1543, T1036.004, T1059.004, T1027.002, T1497.001, T1070.006, T1040, T1573.001]
affected_products: ["Cisco Catalyst SD-WAN Controller", "Cisco Catalyst SD-WAN Manager", "Cisco Catalyst SD-WAN Validator"]
cves:
  - id: CVE-2026-20127
    cvss: "10.0"
    epss: null
    type: auth-bypass
    vector: zero-click
    auth: pre-auth
    status: [exploited, cisa-kev, patch-available]
    affected: "Cisco Catalyst SD-WAN Controller, Manager and Validator regardless of configuration, on-premises and Cisco-hosted; releases earlier than 20.9 must migrate, and 20.11, 20.13, 20.14 and 20.16 have reached end of software maintenance"
    fixed: "20.9.8.2 (20.9); 20.12.5.3 or 20.12.6.1 (20.12); 20.15.4.2 (20.15); 20.18.2.1 (20.18); 20.11 moves to 20.12.6.1, 20.13 and 20.14 to 20.15.4.2, 20.16 to 20.18.2.1"
sources:
  - url: "https://blog.talosintelligence.com/uat-11473-keydrift/"
    publisher: "Cisco Talos"
    date: "2026-10-28"
    role: primary
  - url: "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk"
    publisher: "Cisco PSIRT"
    date: "2026-10-28"
    role: primary
  - url: "https://www.lumen.com/blog/en-us/silent-train-volt-typhoon-operational-framework"
    publisher: "Lumen Black Lotus Labs"
    date: "2026-03-16"
    role: corroborating
  - url: "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"
    publisher: "CISA Known Exploited Vulnerabilities catalog"
    date: "2026-10-28"
    role: corroborating
closed_sources: []
evidence:
  - quote: "Observed targeting spans across space and satellite services, defense and aerospace technology, and policy research."
    publisher: "Cisco Talos"
    source_url: "https://blog.talosintelligence.com/uat-11473-keydrift/"
  - quote: "The legitimate Cisco aaamgr component is a Python package; it does not normally appear as a compiled ELF runit service."
    publisher: "Cisco Talos"
    source_url: "https://blog.talosintelligence.com/uat-11473-keydrift/"
  - quote: "The Cisco PSIRT is aware of limited exploitation of this vulnerability."
    publisher: "Cisco PSIRT"
    source_url: "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk"
  - quote: "Exploitation continued well after Cisco disclosed the vulnerability in February 2026, underscoring Volt Typhoon’s sustained interest in it."
    publisher: "Lumen Black Lotus Labs"
    source_url: "https://www.lumen.com/blog/en-us/silent-train-volt-typhoon-operational-framework"
verification: multi-source
sourcing_note: >
  The KeyDrift analysis rests on Talos alone; Cisco's own advisory is the first-party source for the flaw, its fixed releases and the statement that it
  knows of limited exploitation, and Lumen independently reports Volt Typhoon exploiting the same flaw from late 2025. Talos calls the activity
  historical and gives no count of affected controllers; its overlap with Silent Train is an infrastructure overlap, not an attribution of UAT-11473 to Volt Typhoon.
confidence: high
references: ["2026-06-06/cve-2026-20245-cisco-catalyst-sd-wan-manager-actively-exploi"]
deep_dive: false
deep_dive_category: null
org_triage: null
classification:
  reliability: B
  credibility: 2
watchlist_hit: false
actions:
  - "Upgrade every Cisco Catalyst SD-WAN Controller, Manager and Validator to its first fixed release (20.9.8.2, 20.12.5.3 or 20.12.6.1, 20.15.4.2 or 20.18.2.1; releases earlier than 20.9 must migrate), and until then limit ports 22 and 830 on the control components to known controller and management addresses, because Cisco offers no workaround."
updates: []
migrated_from: null
---

Cisco Talos reports that UAT-11473 exploited CVE-2026-20127, an authentication bypass in the peering authentication of Cisco Catalyst SD-WAN Controller ([Cisco PSIRT, 2026-10-28](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk)), and then installed a custom framework it calls KeyDrift ([Cisco Talos, 2026-10-28](https://blog.talosintelligence.com/uat-11473-keydrift/)). CISA has listed the flaw in its Known Exploited Vulnerabilities catalog since 2026-02-25 ([CISA KEV, 2026-10-28](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)). Cisco's advisory (CVSS 10.0) says an unauthenticated remote attacker can log in as an internal high-privileged non-root user and reach NETCONF to change the SD-WAN fabric configuration, and that there is no workaround ([Cisco PSIRT, 2026-10-28](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk)). Cisco's advisory, revised on 2026-10-28 to link Talos's post, says its PSIRT is aware of limited exploitation ([Cisco PSIRT, 2026-10-28](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk)). Lumen's Black Lotus Labs reported in March that Volt Typhoon had exploited the flaw since late 2025 and after Cisco's February disclosure ([Lumen Black Lotus Labs, 2026-03-16](https://www.lumen.com/blog/en-us/silent-train-volt-typhoon-operational-framework)), and Talos assesses with high confidence that UAT-11473's operating infrastructure overlaps considerably with Volt Typhoon's Silent Train network ([Cisco Talos, 2026-10-28](https://blog.talosintelligence.com/uat-11473-keydrift/)).

KeyDrift runs inside the control-plane daemon. The actor edits the runit launchers of sshd and of a look-alike aaamgr service and remounts /rootfs.rw executable: the sshd launcher starts a script that injects the PolyFlame library into every running vdaemon process by ptrace, and the aaamgr launcher runs a packed PolyFlame loader directly ([Cisco Talos, 2026-10-28](https://blog.talosintelligence.com/uat-11473-keydrift/)). PolyFlame is tasked in-band over the control-plane traffic and offers a command, file-write and file-read backdoor and an intermediate command relay; Talos recovered no hardcoded address, port or domain ([Cisco Talos, 2026-10-28](https://blog.talosintelligence.com/uat-11473-keydrift/)). A second component, LittleFilch, hooks SSL_read in vdaemon and collects peer system addresses and 32-byte values Talos assesses to be OMP-distributed IPsec data-plane keys, writing them RSA-encrypted to /var/tmp ([Cisco Talos, 2026-10-28](https://blog.talosintelligence.com/uat-11473-keydrift/)). Talos lists observed targeting as space and satellite services, defense and aerospace technology, and policy research, calls the activity historical and does not say how many controllers were affected ([Cisco Talos, 2026-10-28](https://blog.talosintelligence.com/uat-11473-keydrift/)).

**Exposure:** every Catalyst SD-WAN Controller, Manager and Validator regardless of configuration, on-premises or in Cisco's hosted clouds, on a release below the first fixed one in the advisory's table; Cisco says controllers with ports exposed to the internet are at risk ([Cisco PSIRT, 2026-10-28](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk)).

**Detection:** on the controller's authentication log, Cisco says to audit /var/log/auth.log for accepted public-key logins of the vmanage-admin account from addresses that are not among the configured System IPs, and to validate control-connection peering events, those of peer type vmanage first, against maintenance windows and asset inventory ([Cisco PSIRT, 2026-10-28](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk)). On the host, Talos names modified runit run scripts that remount the overlay root executable and start a background script, an aaamgr service that runs a compiled, packed ELF, extra libraries mapped into vdaemon with ptrace activity against it and encrypted staging files under /var/tmp ([Cisco Talos, 2026-10-28](https://blog.talosintelligence.com/uat-11473-keydrift/)). Cisco asks for admin-tech files and a TAC case when compromise is suspected ([Cisco PSIRT, 2026-10-28](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk)).

**Triage:** an aaamgr service that runs as a compiled ELF is the discriminator, because the legitimate component is a Python package and does not normally appear that way ([Cisco Talos, 2026-10-28](https://blog.talosintelligence.com/uat-11473-keydrift/)).

**Defender takeaway:** upgrade to the fixed releases and restrict the control components' management ports, then treat any controller that was internet-reachable on a vulnerable release as a compromise-assessment target, because Lumen dates exploitation of the flaw to late 2025, before Cisco's February disclosure, and the implant runs in the process that handles the fabric's control sessions.