Cisco Talos disclosed on October 28, 2026, that an advanced persistent threat actor tracked as UAT-11473 exploited Cisco SD-WAN controllers to deploy a custom malware framework named KeyDrift. The actor leveraged an authentication bypass vulnerability to gain unauthorized access.
Exploitation and Targeting
According to Cisco Talos, the advanced persistent threat actor UAT-11473 exploited CVE-2026-20127, an authentication bypass vulnerability in Cisco SD-WAN Catalyst Controller instances. The actor gained unauthorized access and installed a custom malware framework known as KeyDrift.
Observed targeting by the group spans space and satellite services, defense and aerospace technology, and policy research. Talos assessed with high confidence that UAT-11473's infrastructure overlaps with Volt Typhoon's Silent Train covert access network.
The KeyDrift Malware Framework
KeyDrift operates inside Cisco SD-WAN control-plane processes to intercept decrypted control traffic and extract sensitive keying material. Its primary component, PolyFlame, is a memory-resident module injected into running vdaemon processes via modified runit service paths.
Another component, LittleFilch, hooks SSL_read inside vdaemon to extract control-session identifiers and data-plane keying material. The extracted data is encrypted and staged locally for exfiltration.
What to do
- Prioritize the application of patches released by Cisco for CVE-2026-20127 and follow the published hardening guide for Cisco Catalyst SD-WAN deployments.
- Monitor systems for indicators of post-compromise activity and immediately activate incident response frameworks if unauthorized activity is detected.
- Contact the Cisco Technical Assistance Center (TAC) for support by initiating a TAC request.
Key facts and where they come from
- UAT-11473 exploited CVE-2026-20127 to gain unauthorized access to Cisco SD-WAN Catalyst Controller instances.
exploited CVE-2026-20127, an authentication bypass vulnerability in Cisco SD-WAN Catalyst Controller instances to bypass authentication and gain unauthorized access to affected systems.
- KeyDrift is a custom malware framework designed to operate in Cisco SD-WAN controller environments.
KeyDrift is a custom malware framework that is designed to operate in Cisco SD-WAN controller environments.
