Executive Summary
In October 2026, details emerged regarding the exploitation of CVE-2026-20127, a CVSS 10.0 authentication bypass vulnerability in Cisco Catalyst SD-WAN (formerly vSmart, vManage, and vBond). A threat actor tracked as UAT-11473 exploited this flaw to plant 'KeyDrift', a custom malware suite designed to intercept and steal AES-256 encryption keys used for site-to-site traffic.
The attack chain involves gaining unauthenticated administrative access to SD-WAN control systems, followed by the deployment of loaders (aaamgrd, conf_sshd) and injectors (rsshd). The core malware, PolyFlame, resides in memory within the vdaemon process, while a secondary component, LittleFilch, hooks the process to capture decrypted control messages containing key material. The threat actor utilized timestomping and memory-resident execution to minimize their forensic footprint.
This activity is particularly critical as it targets the control plane of SD-WAN infrastructure, potentially compromising the confidentiality of all encrypted traffic across the WAN. Targeted sectors include space and satellite services, defense, aerospace, and policy research. While Cisco has released patches, there is no evidence that upgrading automatically removes existing malware infections.