Skip to content
OriginalSign in
Image: SecurityOnline

SecurityOnlineDo Son

UAT-11473 implants KeyDrift malware on Cisco SD-WAN systems

Part of the CVE-2026-20127 story · since 25 Feb

Developinglatest 26 minutes ago22 articles8 outlets
25 Feb · CISA first29 Jun10 Aug21 SepNowThis article22nd of 22
  • Wed 25 Feb, 17:32 UTC. CISA, first report. CISA adds CVE-2026-20127 after exploit of Cisco SD WAN auth bypass. Cites a CVE in CISA KEV.
  • Wed 25 Feb, 17:34 UTC. CISA. CISA adds CVE-2026-20127: Cisco SD WAN allows admin takeover. Cites a CVE in CISA KEV.
  • Thu 26 Feb, 00:45 UTC. Rapid7, its first report on the story. CISA orders emergency patch for Cisco SD WAN after CVE-2026-20127. Cites a CVE in CISA KEV.
  • Thu 26 Feb, 06:49 UTC. The Hacker News, its first report on the story. Critical CVE-2026-20127 in Cisco SD WAN gives remote admin access. Cites a CVE in CISA KEV.
  • Thu 26 Feb, 09:52 UTC. SecurityWeek, its first report on the story. Cisco patches exploited Catalyst SD WAN zero day CVE-2026-20127. Cites a CVE in CISA KEV.
  • Thu 26 Feb, 09:53 UTC. Infosecurity, its first report on the story. Five Eyes warn Cisco SD WAN zero day grants admin CVE-2026-20127. Cites a CVE in CISA KEV.
  • Thu 26 Feb, 12:56 UTC. Security Affairs, its first report on the story. CVE-2026-20127: Critical Cisco SD WAN flaw gives root access. Cites a CVE in CISA KEV.
  • Thu 26 Feb, 16:01 UTC. Security Affairs. CISA: CVE-2026-20127 lets attackers gain admin on Cisco SD WAN. Cites a CVE in CISA KEV.
  • Thu 26 Feb, 22:10 UTC. Dark Reading, its first report on the story. Cisco Catalyst SD WAN zero day CVE-2026-20127 exploited for years. Cites a CVE in CISA KEV.
  • Mon 2 Mar, 14:13 UTC. The Hacker News. Cisco SD WAN CVE-2026-20127 flaw bypasses auth for admin. Cites a CVE in CISA KEV.
  • Thu 5 Mar, 12:29 UTC. SecurityWeek. Catalyst SD WAN flaws CVE-2026-20128 exploited, Cisco warns. Cites a CVE in CISA KEV.
  • Thu 5 Mar, 16:41 UTC. The Hacker News. Cisco warns CVE-2026-20122 and CVE-2026-20128 exploited in SD-WAN. Cites a CVE in CISA KEV.
  • Sun 8 Mar, 12:49 UTC. SecurityWeek. Cisco Catalyst SDWAN flaw CVE-2026-20127 fuels internet attacks. Cites a CVE in CISA KEV.
  • Thu 12 Mar, 13:09 UTC. Infosecurity. CISA Issues Emergency Directive Over Exploited Cisco SD-WAN Flaws. Cites a CVE in CISA KEV.
  • Fri 13 Mar, 20:15 UTC. Dark Reading. Fake PoCs, Misunderstood Risks Cause Cisco SD-WAN Chaos. Cites a CVE in CISA KEV.
  • Thu 14 May, 19:41 UTC. Security Affairs. U.S. CISA adds a flaw in Cisco Catalyst SD-WAN to its Known Exploited Vulnerabilities catalog. Cites a CVE in CISA KEV.
  • Thu 14 May, 20:51 UTC. Dark Reading. Cisco SD WAN flaw lets attackers seize control, patch urged. Cites a CVE in CISA KEV.
  • Fri 15 May, 06:11 UTC. The Hacker News. CISA warns of Cisco Catalyst SDWAN flaw amid active exploitation. Cites a CVE in CISA KEV.
  • Fri 15 May, 06:41 UTC. SecurityWeek. Cisco patches SDWAN zero day CVE-2026-20182 exploited by UAT8616. Cites a CVE in CISA KEV.
  • Wed 30 Sep, 18:38 UTC. Rapid7. Cisco SD-WAN Flaw Exploited to Grant Attackers Admin Access. Cites a CVE in CISA KEV.
  • Wed 28 Oct, 19:30 UTC. The Hacker News. Volt Typhoon Used Silent Train in Four Zero Day Campaigns. Cites a CVE in CISA KEV.
  • Thu 29 Oct, 03:30 UTC. SecurityOnline, its first report on the story. UAT-11473 implants KeyDrift malware on Cisco SD-WAN systems. Cites a CVE in CISA KEV. This article, 22nd of 22.

Threat actors tracked as UAT-11473 exploited Cisco SD-WAN Catalyst Controllers via CVE-2026-20127, a critical authentication bypass, to implant a custom malware framework called KeyDrift. Cisco Talos reports the intruders began with unauthorised access to vulnerable SD-WAN controllers and proceeded to install a multi-part espionage suite that runs directly inside legitimate control-plane processes, rather than using noisy external beaconing.

The group then altered runit service launch scripts for sshd and aaamgr to survive reboots, mounting /rootfs[.]rw as executable and loading a loader named conf_sshd, which in turn injects the main implant into memory using a ptrace-based technique.

Inside the KeyDrift framework, the memory-resident PolyFlame module (libdssl.so) hooks the recvfrom() API to intercept in-band DTLS control-plane traffic, validating commands via an operator-supplied MD5 hash matched against the local date (YYYY-MM-DD). When confirmed, PolyFlame can act as a TinyShell backdoor or as a C2 relay.

Researchers also observed a packed ELF64 variant of PolyFlame masquerading as the aaamgrd daemon on affected vBond appliances, and a second module, LittleFilch (libcommon.so), hooks OpenSSL's SSL_read in vSmart to exfiltrate 32-byte AES-256 IPsec data-plane keys and edge node IPs, saving encrypted records to /var/tmp/vdaemon[.]bin before transmitting them over UDP.

Cisco Talos links the operation’s infrastructure to Volt Typhoon’s covert network and notes timestomping to align malicious files with legitimate system files. Victims span space and satellite services, defence, aerospace technology, and policy research sectors. Cisco recommends applying CVE-2026-20127 fixes across all SD-WAN Catalyst Controllers, vSmart, and vBond appliances, and auditing for rogue files and altered run scripts to remove or rebuild compromised controllers from trusted images.

How the story developed

All 22 articles
Developinglatest 26 minutes ago22 articles8 outlets

22 articles from 8 outlets since 25 Feb. Picked up again on 28 Oct after 4 weeks quiet. This was the 22nd report, 245 days after the first.

Now25 Feb71212 May28 Sep6111621First reportCISA · 25 Feb, 17:32This article22nd of 22 · day 246
  • Wed 25 Feb, 17:32 UTC. CISA, first report. CISA adds CVE-2026-20127 after exploit of Cisco SD WAN auth bypass. Cites a CVE in CISA KEV.
  • Wed 25 Feb, 17:34 UTC. CISA. CISA adds CVE-2026-20127: Cisco SD WAN allows admin takeover. Cites a CVE in CISA KEV.
  • Thu 26 Feb, 00:45 UTC. Rapid7, its first report on the story. CISA orders emergency patch for Cisco SD WAN after CVE-2026-20127. Cites a CVE in CISA KEV.
  • Thu 26 Feb, 06:49 UTC. The Hacker News, its first report on the story. Critical CVE-2026-20127 in Cisco SD WAN gives remote admin access. Cites a CVE in CISA KEV.
  • Thu 26 Feb, 09:52 UTC. SecurityWeek, its first report on the story. Cisco patches exploited Catalyst SD WAN zero day CVE-2026-20127. Cites a CVE in CISA KEV.
  • Thu 26 Feb, 09:53 UTC. Infosecurity, its first report on the story. Five Eyes warn Cisco SD WAN zero day grants admin CVE-2026-20127. Cites a CVE in CISA KEV.
  • Thu 26 Feb, 12:56 UTC. Security Affairs, its first report on the story. CVE-2026-20127: Critical Cisco SD WAN flaw gives root access. Cites a CVE in CISA KEV.
  • Thu 26 Feb, 16:01 UTC. Security Affairs. CISA: CVE-2026-20127 lets attackers gain admin on Cisco SD WAN. Cites a CVE in CISA KEV.
  • Thu 26 Feb, 22:10 UTC. Dark Reading, its first report on the story. Cisco Catalyst SD WAN zero day CVE-2026-20127 exploited for years. Cites a CVE in CISA KEV.
  • Mon 2 Mar, 14:13 UTC. The Hacker News. Cisco SD WAN CVE-2026-20127 flaw bypasses auth for admin. Cites a CVE in CISA KEV.
  • Thu 5 Mar, 12:29 UTC. SecurityWeek. Catalyst SD WAN flaws CVE-2026-20128 exploited, Cisco warns. Cites a CVE in CISA KEV.
  • Thu 5 Mar, 16:41 UTC. The Hacker News. Cisco warns CVE-2026-20122 and CVE-2026-20128 exploited in SD-WAN. Cites a CVE in CISA KEV.
  • Sun 8 Mar, 12:49 UTC. SecurityWeek. Cisco Catalyst SDWAN flaw CVE-2026-20127 fuels internet attacks. Cites a CVE in CISA KEV.
  • Thu 12 Mar, 13:09 UTC. Infosecurity. CISA Issues Emergency Directive Over Exploited Cisco SD-WAN Flaws. Cites a CVE in CISA KEV.
  • Fri 13 Mar, 20:15 UTC. Dark Reading. Fake PoCs, Misunderstood Risks Cause Cisco SD-WAN Chaos. Cites a CVE in CISA KEV.
  • Thu 14 May, 19:41 UTC. Security Affairs. U.S. CISA adds a flaw in Cisco Catalyst SD-WAN to its Known Exploited Vulnerabilities catalog. Cites a CVE in CISA KEV.
  • Thu 14 May, 20:51 UTC. Dark Reading. Cisco SD WAN flaw lets attackers seize control, patch urged. Cites a CVE in CISA KEV.
  • Fri 15 May, 06:11 UTC. The Hacker News. CISA warns of Cisco Catalyst SDWAN flaw amid active exploitation. Cites a CVE in CISA KEV.
  • Fri 15 May, 06:41 UTC. SecurityWeek. Cisco patches SDWAN zero day CVE-2026-20182 exploited by UAT8616. Cites a CVE in CISA KEV.
  • Wed 30 Sep, 18:38 UTC. Rapid7. Cisco SD-WAN Flaw Exploited to Grant Attackers Admin Access. Cites a CVE in CISA KEV.
  • Wed 28 Oct, 19:30 UTC. The Hacker News. Volt Typhoon Used Silent Train in Four Zero Day Campaigns. Cites a CVE in CISA KEV.
  • Thu 29 Oct, 03:30 UTC. SecurityOnline, its first report on the story. UAT-11473 implants KeyDrift malware on Cisco SD-WAN systems. Cites a CVE in CISA KEV. This article, 22nd of 22.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 22 articles as a list
  1. Wed 25 FebDay 02
    1. CISA adds CVE-2026-20127 after exploit of Cisco SD WAN auth bypass17:32 · CISA · official · First report · CISA alert · Known exploited CVE
    2. CISA adds CVE-2026-20127: Cisco SD WAN allows admin takeover17:34 · CISA · official · Known exploited CVE
  2. Thu 26 FebDay 17
    1. CISA orders emergency patch for Cisco SD WAN after CVE-2026-2012700:45 · Rapid7 · Known exploited CVE
    2. Critical CVE-2026-20127 in Cisco SD WAN gives remote admin access06:49 · The Hacker News · Known exploited CVE
    3. Cisco patches exploited Catalyst SD WAN zero day CVE-2026-2012709:52 · SecurityWeek · Known exploited CVE
    Show 4 more from 26 Feb
    1. Five Eyes warn Cisco SD WAN zero day grants admin CVE-2026-2012709:53 · Infosecurity · Known exploited CVE
    2. CVE-2026-20127: Critical Cisco SD WAN flaw gives root access12:56 · Security Affairs · Known exploited CVE
    3. CISA: CVE-2026-20127 lets attackers gain admin on Cisco SD WAN16:01 · Security Affairs · Known exploited CVE
    4. Cisco Catalyst SD WAN zero day CVE-2026-20127 exploited for years22:10 · Dark Reading · Known exploited CVE

  3. Quiet for 4 days

    Mon 2 MarDay 51
    1. Cisco SD WAN CVE-2026-20127 flaw bypasses auth for admin14:13 · The Hacker News · Picked up again · Known exploited CVE

  4. Quiet for 3 days

    Thu 5 MarDay 82
    1. Catalyst SD WAN flaws CVE-2026-20128 exploited, Cisco warns12:29 · SecurityWeek · Picked up again · Known exploited CVE
    2. Cisco warns CVE-2026-20122 and CVE-2026-20128 exploited in SD-WAN16:41 · The Hacker News · Known exploited CVE

  5. Quiet for 3 days

    Sun 8 MarDay 111
    1. Cisco Catalyst SDWAN flaw CVE-2026-20127 fuels internet attacks12:49 · SecurityWeek · Picked up again · Known exploited CVE

  6. Quiet for 4 days

    Thu 12 MarDay 151
    1. CISA Issues Emergency Directive Over Exploited Cisco SD-WAN Flaws13:09 · Infosecurity · Picked up again · Known exploited CVE
  7. Fri 13 MarDay 161
    1. Fake PoCs, Misunderstood Risks Cause Cisco SD-WAN Chaos20:15 · Dark Reading · Known exploited CVE

  8. Quiet for 9 weeks

    Thu 14 MayDay 782
    1. U.S. CISA adds a flaw in Cisco Catalyst SD-WAN to its Known Exploited Vulnerabilities catalog19:41 · Security Affairs · Picked up again · Known exploited CVE
    2. Cisco SD WAN flaw lets attackers seize control, patch urged20:51 · Dark Reading · Known exploited CVE
  9. Fri 15 MayDay 792
    1. CISA warns of Cisco Catalyst SDWAN flaw amid active exploitation06:11 · The Hacker News · Known exploited CVE
    2. Cisco patches SDWAN zero day CVE-2026-20182 exploited by UAT861606:41 · SecurityWeek · Known exploited CVE

  10. Quiet for 20 weeks

    Wed 30 SepDay 2171
    1. Cisco SD-WAN Flaw Exploited to Grant Attackers Admin Access18:38 · Rapid7 · Picked up again · Known exploited CVE

  11. Quiet for 4 weeks

    Wed 28 OctDay 2451
    1. Volt Typhoon Used Silent Train in Four Zero Day Campaigns19:30 · The Hacker News · Picked up again · Known exploited CVE
  12. Thu 29 OctDay 2461
    1. UAT-11473 implants KeyDrift malware on Cisco SD-WAN systems03:30 · SecurityOnline · Known exploited CVE · This article, 22nd of 22

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in