CVE-2026-20127 Cisco SD-WAN: exploited, KeyDrift malware

Call: Patch now. CVE-2026-20127 isn’t new. Cisco fixed it in February, and CISA has listed it as exploited since Feb 25. What’s new is that Cisco Talos says a group it tracks as UAT-11473 is using it to plant a malware family called KeyDrift on SD-WAN control components, and Cisco updated its advisory on Oct 28 to point to that report. Talos says the activity overlaps with infrastructure tied to Volt Typhoon. If your SD-WAN controllers are still on a pre-February release, patch them and hunt.

What breaks: The peering authentication in the SD-WAN control components doesn’t work properly. An unauthenticated remote attacker who sends crafted requests can log in as an internal high-privileged account, reach NETCONF, and change configuration across the whole SD-WAN fabric.

Who’s hit: Catalyst SD-WAN Controller (vSmart), Manager (vManage) and Validator (vBond), regardless of configuration. That includes on-prem and Cisco-hosted deployments. Cisco lists no workaround.

First fixed releases: 20.9.8.2, 20.12.5.3 or 20.12.6.1, 20.15.4.2, 20.18.2.1. Check your train in Cisco’s advisory.

Look for compromise. Talos lists these:

Files: /tmp/system-vdaemon, /var/tmp/vdaemon.bin, /var/tmp/vdaemon.conf, and files named libdssl.so, rsshd, conf_sshd, aaamgrd or libcommon.so that don’t belong there.
Logs: “Accepted publickey for vmanage-admin” in auth.log from IP addresses you don’t recognize.
Snort coverage: SIDs 65938, 65958 and 67387-67416 (Snort 3: 7:44-7:73).

Until you’re patched, limit who can reach the control components with ACLs, per Cisco’s guidance. If you find any of the above, patching won’t remove it. Treat the controllers as compromised.

Sources: Cisco advisory (opens in a new tab), Cisco Talos (opens in a new tab), CISA KEV (opens in a new tab).

CVE-2026-20127 Cisco SD-WAN: exploited, KeyDrift malware

Sources

More from October 2026 patch cycle