A Chinese-linked crew is quietly living inside Cisco's SD-WAN brains and stealing the keys
Cisco Talos says UAT-11473 used a critical authentication bug to plant KeyDrift malware on SD-WAN controllers at satellite, defence and policy targets. The infrastructure overlaps with Volt Typhoon.
Key points - Cisco Talos says a group it calls UAT-11473 broke into Cisco SD-WAN controllers and planted custom malware named KeyDrift to steal encryption keys and keep a hidden foothold, with infrastructure that overlaps the Chinese state-linked group Volt Typhoon. - The attackers used CVE-2026-20127, an authentication bypass rated the maximum severity of 10 out of 10. - CISA added the flaw to its must-patch list and gave federal agencies a short deadline to fix it. - Talos says the victims include space and satellite operators, defence and aerospace firms, and policy research outfits. - KeyDrift sits inside the controller's own processes and copies the keys that protect traffic across the whole SD-WAN network.
Cisco's Talos threat research team published the findings, and the detail that matters is where the malware lives. Not on a laptop or a file server. On the box that runs the network.
An SD-WAN controller is the brain of a company's wide-area network, the system that tells every branch office router how to talk to every other one and hands out the encryption keys that keep that traffic private. Get into the brain and you don't need to break into anything else.
That's what UAT-11473 did. We've tracked Volt Typhoon's moves in five stories since July, including an October report on a separate SD-WAN authentication bypass that CISA was already treating as actively exploited.
How did the attackers get in?
They walked through the front door without a password. CVE-2026-20127 is an authentication bypass: the login check on the controller was broken in a way that let a stranger on the internet send a specially shaped request and be treated as a trusted internal user.
From there, Talos says, the attacker could reach NETCONF, the standard interface used to reconfigure network gear, and change how the SD-WAN fabric routes and protects traffic. In web-security terms this is closer to a broken access-control bug than anything exotic. The novelty is the target, not the technique.
What does KeyDrift actually do?
KeyDrift is a bespoke toolkit built to live inside SD-WAN controllers. Talos describes it as several pieces working together: components that quietly collect keying material, meaning the cryptographic keys that scramble network traffic, alongside backdoors and relay points for the attackers' commands.
The nasty part is where it hooks in. KeyDrift runs inside the control-plane processes, the software that handles key exchange, so it can read traffic after it's already been decrypted. A network engineer looking at the wire would see nothing wrong. Talos says the framework is built for the long haul, with automated exfiltration of keys rather than smash-and-grab theft.
Who is behind it?
Talos tracks the group as UAT-11473 and says, with high confidence, that its infrastructure overlaps considerably with Volt Typhoon's "Silent Train" covert access network. Volt Typhoon is the Chinese state-linked crew that US and allied agencies have repeatedly accused of pre-positioning inside Western critical infrastructure.
The victim profile fits that pattern. Space and satellite operators, defence and aerospace firms, policy research outfits. These are intelligence targets, not extortion targets.
What should network teams do now?
Patch the controller, then assume it was already touched. Any SD-WAN Controller, Manager or Validator still unpatched in late 2026 should be treated as suspect.
| Item | Value |
|---|---|
| CVE | CVE-2026-20127 |
| CVSS score | 10.0 (critical) |
| Affected | Cisco SD-WAN Controller, Manager, Validator |
Because KeyDrift targets keys, a clean reinstall isn't enough on its own. Any certificates and pre-shared keys that lived on an exposed controller should be rotated, and the SD-WAN fabric's trust re-established from a known-good state.
One judgement, for the people who have to sit with this. The scariest part of KeyDrift isn't the code. It's that an espionage crew decided the quickest route into satellite operators and defence contractors was the SD-WAN controller sitting in their own data centre. That tells you where the soft tissue of corporate networks now lives.
