What happened
Hackers identified as UAT‑11473 have been exploiting CVE‑2026‑20127, an authentication‑bypass vulnerability in Cisco Catalyst SD‑WAN Controllers, to gain privileged access and add rogue peers. After gaining access, they deploy the custom KeyDrift malware, which consists of PolyFlame (process injection) and LittleFilch (control‑session interception). The malware intercepts decrypted control‑plane traffic, extracts IPsec key material, encrypts it with RSA, stores it locally, and exfiltrates it via UDP. The campaign, linked to the Chinese state‑sponsored Volt Typhoon group, targets space and satellite services, defense and aerospace technology firms, and policy‑research organizations, providing long‑term persistence and automated data exfiltration.
Why it matters for trust and compliance
- The exploit underscores the importance of stringent access‑control and privileged‑account management for network‑infrastructure components, a control objective that maps across multiple frameworks such as NIST CSF and ISO 27001.
- Validate that authentication controls for SD‑WAN controllers are enforced and evidence of patch compliance is collected.
- Implement continuous monitoring of control‑plane processes for unauthorized modifications and anomalous outbound traffic.
Who is affected
TECH_SAAS GOV_PUBLIC
Recommended actions
- Confirm installation of Cisco’s February 2026 patch for CVE‑2026‑20127 on all SD‑WAN controllers.
- Audit SD‑WAN peer configurations and disable any default or unused credentials.
- Enable and retain detailed logs of control‑plane processes; set alerts for unknown services or file writes in /var/tmp.
- Run threat‑hunt queries for PolyFlame and LittleFilch artifacts and for unexpected UDP exfiltration.
- Document remediation steps and retain logs as audit‑ready evidence.
Details
- CVEs
- CVE-2026-20127