Cisco's security advisory for CVE-2026-20127 (cisco-sa-sdwan-rpa-EHchtZk; first published 25 February 2026; version 2.1, last updated 28 October 21:54 GMT, which is 29 October 05:54 Perth) says a vulnerability in the peering authentication of Cisco Catalyst SD-WAN Controller, Manager and Validator could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges; it says the Cisco PSIRT is aware of limited exploitation, lists no workarounds and now refers customers to a Talos post. (source: Cisco)

Cisco Talos said on 28 October 2026 that it has identified UAT-11473, which it describes as a highly sophisticated advanced persistent threat actor, exploiting CVE-2026-20127, an authentication bypass vulnerability in Cisco Catalyst SD-WAN Controller instances, to gain unauthorized access and then install a custom malware framework it tracks as KeyDrift.

Talos describes its post as an analysis of historical UAT-11473 activity and does not give dates for the intrusions. According to Talos, KeyDrift's primary component, PolyFlame, is a memory-resident module deployed through modified runit service paths and injected into legitimate vdaemon processes, where it can act as a TinyShell-style backdoor or as an intermediate command-and-control relay; another component, LittleFilch, hooks SSL_read inside vdaemon, extracts keying material for a list of predefined edge nodes (which Talos assesses as OMP-distributed AES-256 IPsec data-plane key material) and stages it RSA-encrypted in /var/tmp/vdaemon.bin for exfiltration.

Talos says observed targeting spans space and satellite services, defense and aerospace technology, and policy research, and assesses with high confidence that UAT-11473's operating infrastructure overlaps considerably with Volt Typhoon's 'Silent Train' covert access network (see the Silent Train card).

Talos published Snort rules 67387 through 67416 (Snort 2) and 7:44 through 7:73 (Snort 3) for the KeyDrift artifacts; SIDs 65938 and 65958 already cover the CVE itself. (source: Cisco Talos) CISA has listed CVE-2026-20127 in its Known Exploited Vulnerabilities catalog since 25 February 2026. (source: CISA KEV)