Zero‑Day Exploitation of Cisco SD‑WAN Authentication Bypass (CVE‑2026‑20127) Enables KeyDrift Malware Deployment
What It Is — A newly disclosed authentication‑bypass vulnerability (CVE‑2026‑20127) in Cisco Catalyst SD‑WAN Controllers allows remote attackers to obtain privileged access and add rogue peers. Although Cisco issued a patch in February 2026, the APT group tracked as UAT‑11473 (linked to the Volt Typhoon “Silent Train” campaign) has been exploiting the flaw as a zero‑day since at least 2023. The attackers deploy a custom malware framework called KeyDrift, which runs inside SD‑WAN control‑plane processes, intercepts decrypted traffic, extracts IPsec key material, and exfiltrates it via encrypted UDP packets. The campaign targets space and satellite services, defense and aerospace technology firms, and policy‑research organizations, providing long‑term persistence and automated data theft.
Affected Products — Cisco Catalyst SD‑WAN Controllers and Manager (all versions prior to the February 2026 patch).
Why It Matters for Trust & Control Assurance — The incident tests the access‑control objective: ensuring that only authorized entities can manage SD‑WAN infrastructure and that privileged actions are tightly governed.
Recommended Actions —
- Verify that the February 2026 patch for CVE‑2026‑20127 is applied on every SD‑WAN controller.
- Conduct a configuration audit to confirm that only approved peers are defined and that default credentials are disabled.
- Enable detailed logging of control‑plane processes and monitor for unknown services or file modifications (e.g.,
/var/tmp/vdaemon.bin). - Perform threat‑hunt queries for the KeyDrift components (PolyFlame, LittleFilch) and any anomalous outbound UDP traffic.
- Document the remediation steps as evidence for audit readiness.
Source: BleepingComputer