CVE-2026-20127CVSS 10SD-WAN peering authentication bypass
Crafted requests can give an unauthenticated remote attacker privileged access and permit network-configuration changes.
Talos discloses KeyDrift implants stealing key material from Cisco SD-WAN controllers
Talos reports UAT-11473 exploiting CVE-2026-20127 to install persistent controller implants and collect key material. This is a newly disclosed campaign using a previously patched flaw, not a new zero-day.
- Disclosed
- Oct 28, 2026
- Public disclosure date
- Severity
- CVSS 10
- 1 CVE tracked here
- Splash zone
- Unpatched Catalyst SD-WAN Controller, Manager and Validator deployments; investigate exposed or previously compromised control components
- network
- In the wild
- Yes
- Cisco Talos reports exploitation and recovered controller implants.
What happened
Talos disclosed this campaign on October 28. PolyFlame provides persistent access inside controller processes; LittleFilch inspects decrypted control traffic and extracts material assessed to be IPsec data-plane keys. The affected products are control components, not every Cisco firewall. The advisory covers on-premises and Cisco-hosted deployments, regardless of configuration.
The entry flaw was disclosed in February. L4 reflects recovered implants and observed exploitation in the newly reported campaign. Talos assesses infrastructure overlap with Volt Typhoon’s Silent Train network; overlap does not establish that the groups are identical. No victim total or proof of decryption of all customer traffic is provided.
Use the vendor’s upgrade and investigation procedures together. The fixed-release table does not certify that a previously compromised controller is clean.
What’s in the bowl
Fixed versions
| Product | Safe from | Note |
|---|---|---|
| Catalyst SD-WAN 20.9 | 20.9.8.2 | |
| Catalyst SD-WAN 20.12 | 20.12.5.3 / 20.12.6.1 | |
| Catalyst SD-WAN 20.15 | 20.15.4.2 | |
| Catalyst SD-WAN 20.18 | 20.18.2.1 | |
| Earlier and end-of-maintenance releases | No fix | Migrate using Cisco’s compatibility and upgrade matrices |
Crime-scene timeline
Feb 25, 2026
Cisco publishes the authentication-bypass advisory and fixes
Oct 28, 2026
Talos publishes the KeyDrift campaign analysis; Cisco updates its advisory
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- Cisco Talos KeyDrift analysisPrimaryDocuments recovered implants, key collection, targeting, indicators and response guidance.
- Cisco PSIRT advisoryPrimaryDefines affected roles, fixed releases, temporary access restrictions and log checks.
- Cisco Catalyst SD-WAN Hardening GuidePrimaryDeployment hardening guidance; coordinate restrictions with legitimate topology requirements.