Skip to content
OriginalSign in
Image: SecurityWeek

SecurityWeekEduard Kovacs

Cisco SD WAN flaw tied to UAT-11473 and Volt Typhoon

Part of the CVE-2026-20127 story · since 25 Feb

Developinglatest 39 minutes ago24 articles8 outlets
25 Feb · CISA first29 Jun10 Aug21 SepNowThis article24th of 24
  • Wed 25 Feb, 17:32 UTC. CISA, first report. CISA adds CVE-2026-20127 after exploit of Cisco SD WAN auth bypass. Cites a CVE in CISA KEV.
  • Wed 25 Feb, 17:34 UTC. CISA. CISA adds CVE-2026-20127: Cisco SD WAN allows admin takeover. Cites a CVE in CISA KEV.
  • Thu 26 Feb, 00:45 UTC. Rapid7, its first report on the story. CISA orders emergency patch for Cisco SD WAN after CVE-2026-20127. Cites a CVE in CISA KEV.
  • Thu 26 Feb, 06:49 UTC. The Hacker News, its first report on the story. Critical CVE-2026-20127 in Cisco SD WAN gives remote admin access. Cites a CVE in CISA KEV.
  • Thu 26 Feb, 09:52 UTC. SecurityWeek, its first report on the story. Cisco patches exploited Catalyst SD WAN zero day CVE-2026-20127. Cites a CVE in CISA KEV.
  • Thu 26 Feb, 09:53 UTC. Infosecurity, its first report on the story. Five Eyes warn Cisco SD WAN zero day grants admin CVE-2026-20127. Cites a CVE in CISA KEV.
  • Thu 26 Feb, 12:56 UTC. Security Affairs, its first report on the story. CVE-2026-20127: Critical Cisco SD WAN flaw gives root access. Cites a CVE in CISA KEV.
  • Thu 26 Feb, 16:01 UTC. Security Affairs. CISA: CVE-2026-20127 lets attackers gain admin on Cisco SD WAN. Cites a CVE in CISA KEV.
  • Thu 26 Feb, 22:10 UTC. Dark Reading, its first report on the story. Cisco Catalyst SD WAN zero day CVE-2026-20127 exploited for years. Cites a CVE in CISA KEV.
  • Mon 2 Mar, 14:13 UTC. The Hacker News. Cisco SD WAN CVE-2026-20127 flaw bypasses auth for admin. Cites a CVE in CISA KEV.
  • Thu 5 Mar, 12:29 UTC. SecurityWeek. Catalyst SD WAN flaws CVE-2026-20128 exploited, Cisco warns. Cites a CVE in CISA KEV.
  • Thu 5 Mar, 16:41 UTC. The Hacker News. Cisco warns CVE-2026-20122 and CVE-2026-20128 exploited in SD-WAN. Cites a CVE in CISA KEV.
  • Sun 8 Mar, 12:49 UTC. SecurityWeek. Cisco Catalyst SDWAN flaw CVE-2026-20127 fuels internet attacks. Cites a CVE in CISA KEV.
  • Thu 12 Mar, 13:09 UTC. Infosecurity. CISA Issues Emergency Directive Over Exploited Cisco SD-WAN Flaws. Cites a CVE in CISA KEV.
  • Fri 13 Mar, 20:15 UTC. Dark Reading. Fake PoCs, Misunderstood Risks Cause Cisco SD-WAN Chaos. Cites a CVE in CISA KEV.
  • Thu 14 May, 19:41 UTC. Security Affairs. U.S. CISA adds a flaw in Cisco Catalyst SD-WAN to its Known Exploited Vulnerabilities catalog. Cites a CVE in CISA KEV.
  • Thu 14 May, 20:51 UTC. Dark Reading. Cisco SD WAN flaw lets attackers seize control, patch urged. Cites a CVE in CISA KEV.
  • Fri 15 May, 06:11 UTC. The Hacker News. CISA warns of Cisco Catalyst SDWAN flaw amid active exploitation. Cites a CVE in CISA KEV.
  • Fri 15 May, 06:41 UTC. SecurityWeek. Cisco patches SDWAN zero day CVE-2026-20182 exploited by UAT8616. Cites a CVE in CISA KEV.
  • Wed 30 Sep, 18:38 UTC. Rapid7. Cisco SD-WAN Flaw Exploited to Grant Attackers Admin Access. Cites a CVE in CISA KEV.
  • Wed 28 Oct, 19:30 UTC. The Hacker News. Volt Typhoon Used Silent Train in Four Zero Day Campaigns. Cites a CVE in CISA KEV.
  • Thu 29 Oct, 03:30 UTC. SecurityOnline, its first report on the story. UAT-11473 implants KeyDrift malware on Cisco SD-WAN systems. Cites a CVE in CISA KEV.
  • Thu 29 Oct, 09:30 UTC. The Hacker News. Hackers Exploit Cisco SD-WAN Flaw to Steal Encryption Keys. Cites a CVE in CISA KEV.
  • Thu 29 Oct, 11:30 UTC. SecurityWeek. Cisco SD WAN flaw tied to UAT-11473 and Volt Typhoon. Cites a CVE in CISA KEV. This article, 24th of 24.

Cisco Talos has linked a critical SD-WAN vulnerability exploitation to a threat infrastructure that overlaps with Volt Typhoon’s Silent Train network, a finding corroborated by Black Lotus Labs’ ongoing monitoring. The flaw, CVE-2026-20127, published in February 2026, can be exploited remotely without credentials to bypass peering authentication on SD-WAN controllers and grant attackers admin rights, enabling manipulation of the SD-WAN configuration.

Talos attributes the campaigns to the actor group UAT-11473, described as a highly sophisticated APT focused on space, satellite, defence and policy research, though it notes the activity is historical rather than giving a precise timeline.

Security researchers say the attackers planted KeyDrift malware on SD-WAN controllers, with PolyFlame acting as a backdoor and intermediate C2, and LittleFilch used to exfiltrate keying material protecting data-plane traffic. Talos asserts that UAT-11473’s infrastructure overlaps considerably with Volt Typhoon’s Silent Train network, though the groups are not declared the same entity.

Black Lotus Labs has tracked Silent Train since late 2023, describing it as routing attacker traffic through hacked routers and IoT devices, and has observed hundreds of victim notifications and at least four confirmed zero‑day campaigns. These campaigns targeted Versa Director, N-able N-central, Cisco Catalyst SD-WAN, VeloCloud Orchestrator, and likely Quest KACE, with activity observed against organisations including telecoms, government and critical infrastructure across Hawaii, California and Texas.

Lumen notes that Silent Train operators exfiltrated documents on military operations and network structures, suggesting a mix of pre-positioning and espionage activity.

How the story developed

All 24 articles
Developinglatest 39 minutes ago24 articles8 outlets

24 articles from 8 outlets since 25 Feb. Picked up again on 28 Oct after 4 weeks quiet. This was the 24th report, 246 days after the first.

Now25 Feb81312 May28 Sep6111621First reportCISA · 25 Feb, 17:32This article24th of 24 · day 246
  • Wed 25 Feb, 17:32 UTC. CISA, first report. CISA adds CVE-2026-20127 after exploit of Cisco SD WAN auth bypass. Cites a CVE in CISA KEV.
  • Wed 25 Feb, 17:34 UTC. CISA. CISA adds CVE-2026-20127: Cisco SD WAN allows admin takeover. Cites a CVE in CISA KEV.
  • Thu 26 Feb, 00:45 UTC. Rapid7, its first report on the story. CISA orders emergency patch for Cisco SD WAN after CVE-2026-20127. Cites a CVE in CISA KEV.
  • Thu 26 Feb, 06:49 UTC. The Hacker News, its first report on the story. Critical CVE-2026-20127 in Cisco SD WAN gives remote admin access. Cites a CVE in CISA KEV.
  • Thu 26 Feb, 09:52 UTC. SecurityWeek, its first report on the story. Cisco patches exploited Catalyst SD WAN zero day CVE-2026-20127. Cites a CVE in CISA KEV.
  • Thu 26 Feb, 09:53 UTC. Infosecurity, its first report on the story. Five Eyes warn Cisco SD WAN zero day grants admin CVE-2026-20127. Cites a CVE in CISA KEV.
  • Thu 26 Feb, 12:56 UTC. Security Affairs, its first report on the story. CVE-2026-20127: Critical Cisco SD WAN flaw gives root access. Cites a CVE in CISA KEV.
  • Thu 26 Feb, 16:01 UTC. Security Affairs. CISA: CVE-2026-20127 lets attackers gain admin on Cisco SD WAN. Cites a CVE in CISA KEV.
  • Thu 26 Feb, 22:10 UTC. Dark Reading, its first report on the story. Cisco Catalyst SD WAN zero day CVE-2026-20127 exploited for years. Cites a CVE in CISA KEV.
  • Mon 2 Mar, 14:13 UTC. The Hacker News. Cisco SD WAN CVE-2026-20127 flaw bypasses auth for admin. Cites a CVE in CISA KEV.
  • Thu 5 Mar, 12:29 UTC. SecurityWeek. Catalyst SD WAN flaws CVE-2026-20128 exploited, Cisco warns. Cites a CVE in CISA KEV.
  • Thu 5 Mar, 16:41 UTC. The Hacker News. Cisco warns CVE-2026-20122 and CVE-2026-20128 exploited in SD-WAN. Cites a CVE in CISA KEV.
  • Sun 8 Mar, 12:49 UTC. SecurityWeek. Cisco Catalyst SDWAN flaw CVE-2026-20127 fuels internet attacks. Cites a CVE in CISA KEV.
  • Thu 12 Mar, 13:09 UTC. Infosecurity. CISA Issues Emergency Directive Over Exploited Cisco SD-WAN Flaws. Cites a CVE in CISA KEV.
  • Fri 13 Mar, 20:15 UTC. Dark Reading. Fake PoCs, Misunderstood Risks Cause Cisco SD-WAN Chaos. Cites a CVE in CISA KEV.
  • Thu 14 May, 19:41 UTC. Security Affairs. U.S. CISA adds a flaw in Cisco Catalyst SD-WAN to its Known Exploited Vulnerabilities catalog. Cites a CVE in CISA KEV.
  • Thu 14 May, 20:51 UTC. Dark Reading. Cisco SD WAN flaw lets attackers seize control, patch urged. Cites a CVE in CISA KEV.
  • Fri 15 May, 06:11 UTC. The Hacker News. CISA warns of Cisco Catalyst SDWAN flaw amid active exploitation. Cites a CVE in CISA KEV.
  • Fri 15 May, 06:41 UTC. SecurityWeek. Cisco patches SDWAN zero day CVE-2026-20182 exploited by UAT8616. Cites a CVE in CISA KEV.
  • Wed 30 Sep, 18:38 UTC. Rapid7. Cisco SD-WAN Flaw Exploited to Grant Attackers Admin Access. Cites a CVE in CISA KEV.
  • Wed 28 Oct, 19:30 UTC. The Hacker News. Volt Typhoon Used Silent Train in Four Zero Day Campaigns. Cites a CVE in CISA KEV.
  • Thu 29 Oct, 03:30 UTC. SecurityOnline, its first report on the story. UAT-11473 implants KeyDrift malware on Cisco SD-WAN systems. Cites a CVE in CISA KEV.
  • Thu 29 Oct, 09:30 UTC. The Hacker News. Hackers Exploit Cisco SD-WAN Flaw to Steal Encryption Keys. Cites a CVE in CISA KEV.
  • Thu 29 Oct, 11:30 UTC. SecurityWeek. Cisco SD WAN flaw tied to UAT-11473 and Volt Typhoon. Cites a CVE in CISA KEV. This article, 24th of 24.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 24 articles as a list
  1. Wed 25 FebDay 02
    1. CISA adds CVE-2026-20127 after exploit of Cisco SD WAN auth bypass17:32 · CISA · official · First report · CISA alert · Known exploited CVE
    2. CISA adds CVE-2026-20127: Cisco SD WAN allows admin takeover17:34 · CISA · official · Known exploited CVE
  2. Thu 26 FebDay 17
    1. CISA orders emergency patch for Cisco SD WAN after CVE-2026-2012700:45 · Rapid7 · Known exploited CVE
    2. Critical CVE-2026-20127 in Cisco SD WAN gives remote admin access06:49 · The Hacker News · Known exploited CVE
    3. Cisco patches exploited Catalyst SD WAN zero day CVE-2026-2012709:52 · SecurityWeek · Known exploited CVE
    Show 4 more from 26 Feb
    1. Five Eyes warn Cisco SD WAN zero day grants admin CVE-2026-2012709:53 · Infosecurity · Known exploited CVE
    2. CVE-2026-20127: Critical Cisco SD WAN flaw gives root access12:56 · Security Affairs · Known exploited CVE
    3. CISA: CVE-2026-20127 lets attackers gain admin on Cisco SD WAN16:01 · Security Affairs · Known exploited CVE
    4. Cisco Catalyst SD WAN zero day CVE-2026-20127 exploited for years22:10 · Dark Reading · Known exploited CVE

  3. Quiet for 4 days

    Mon 2 MarDay 51
    1. Cisco SD WAN CVE-2026-20127 flaw bypasses auth for admin14:13 · The Hacker News · Picked up again · Known exploited CVE

  4. Quiet for 3 days

    Thu 5 MarDay 82
    1. Catalyst SD WAN flaws CVE-2026-20128 exploited, Cisco warns12:29 · SecurityWeek · Picked up again · Known exploited CVE
    2. Cisco warns CVE-2026-20122 and CVE-2026-20128 exploited in SD-WAN16:41 · The Hacker News · Known exploited CVE

  5. Quiet for 3 days

    Sun 8 MarDay 111
    1. Cisco Catalyst SDWAN flaw CVE-2026-20127 fuels internet attacks12:49 · SecurityWeek · Picked up again · Known exploited CVE

  6. Quiet for 4 days

    Thu 12 MarDay 151
    1. CISA Issues Emergency Directive Over Exploited Cisco SD-WAN Flaws13:09 · Infosecurity · Picked up again · Known exploited CVE
  7. Fri 13 MarDay 161
    1. Fake PoCs, Misunderstood Risks Cause Cisco SD-WAN Chaos20:15 · Dark Reading · Known exploited CVE

  8. Quiet for 9 weeks

    Thu 14 MayDay 782
    1. U.S. CISA adds a flaw in Cisco Catalyst SD-WAN to its Known Exploited Vulnerabilities catalog19:41 · Security Affairs · Picked up again · Known exploited CVE
    2. Cisco SD WAN flaw lets attackers seize control, patch urged20:51 · Dark Reading · Known exploited CVE
  9. Fri 15 MayDay 792
    1. CISA warns of Cisco Catalyst SDWAN flaw amid active exploitation06:11 · The Hacker News · Known exploited CVE
    2. Cisco patches SDWAN zero day CVE-2026-20182 exploited by UAT861606:41 · SecurityWeek · Known exploited CVE

  10. Quiet for 20 weeks

    Wed 30 SepDay 2171
    1. Cisco SD-WAN Flaw Exploited to Grant Attackers Admin Access18:38 · Rapid7 · Picked up again · Known exploited CVE

  11. Quiet for 4 weeks

    Wed 28 OctDay 2451
    1. Volt Typhoon Used Silent Train in Four Zero Day Campaigns19:30 · The Hacker News · Picked up again · Known exploited CVE
  12. Thu 29 OctDay 2463
    1. UAT-11473 implants KeyDrift malware on Cisco SD-WAN systems03:30 · SecurityOnline · Known exploited CVE
    2. Hackers Exploit Cisco SD-WAN Flaw to Steal Encryption Keys09:30 · The Hacker News · Known exploited CVE
    3. Cisco SD WAN flaw tied to UAT-11473 and Volt Typhoon11:30 · SecurityWeek · Known exploited CVE · This article, 24th of 24

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in