Cisco Talos published an analysis on October 28, 2026, of the KeyDrift malware set engineered to persist inside Catalyst SD-WAN controllers and extract cryptographic material that protects traffic between enterprise sites.
The initial access came through CVE-2026-20127, a critical authentication bypass flaw rated 10.0 on the CVSS 3.1 scale. The vulnerability resides in the peer authentication process between the Catalyst SD-WAN Controller, Manager, and Validator (formerly vSmart, vManage, and vBond). A remote attacker without credentials can obtain administrative privileges by sending specially crafted requests.
Cisco released fixes in February 2026. The CVE was added to the CISA catalog on February 25 with a two-day remediation window. Patched versions are 20.9.8.2, 20.12.6.1, 20.15.4.2, and 20.18.2.1 depending on the release train in use. Organizations running versions earlier than 20.9 are advised to migrate.
KeyDrift comprises two primary modules. PolyFlame operates entirely in memory, injected into legitimate vdaemon processes, and functions as a backdoor for command execution, file read/write operations, and command-and-control relay to other compromised devices. LittleFilch intercepts already-decrypted data within the same process, specifically targeting control session identifiers and 32-byte blocks believed to be AES-256 IPsec keys distributed by the OMP protocol.
The extracted material is encrypted with RSA and exfiltrated over UDP disguised as standard DTLS 1.2 records. Persistence is achieved through modified service scripts that masquerade as legitimate system services, with timestamps copied from other files to evade detection.
Observed targets include space and satellite service providers, defense contractors, aerospace technology companies, and public policy research institutes. Cisco Talos treats the activity as historical and does not disclose the exact timeframe of the intrusions or confirm whether any keys were successfully removed from victim networks.
Talos assesses with high confidence that the infrastructure of UAT-11473 shows considerable overlap with the Silent Train covert access network linked to Volt Typhoon, while noting that this does not imply the groups are identical. A second critical flaw, CVE-2026-20182, affecting the same products via the control connection handshake and also scored 10.0, was disclosed in May.
