UAT-11473 Exploits CVE-2026-20127 on Cisco SD-WAN Controllers to Deploy KeyDrift for Encryption Key Harvesting

Cisco Talos identified UAT-11473 injecting KeyDrift into SD-WAN control-plane processes after unauthenticated remote exploitation of CVE-2026-20127, a CVSS 10 flaw allowing admin access without credentials. The PolyFlame module provided backdoor and relay functions while LittleFilch extracted keying material from decrypted traffic. Exploitation began by late 2025 and persisted after February 2026 disclosure. Lumen Black Lotus Labs mapped Silent Train as a rotating chain of compromised routers and IoT devices used in at least four confirmed zero-day campaigns against management platforms including Versa Director, N-able N-central, and VeloCloud Orchestrator. Talos assessed high-confidence infrastructure overlap with UAT-11473 but stopped short of equating the groups. Victims clustered in defense, satellite, and critical infrastructure sectors across Hawaii, California, and Texas. The pattern reveals sustained post-disclosure exploitation of known vulnerabilities in control-plane systems. Sophisticated actors prioritize these platforms for broad network access and pre-positioning, bypassing standard patch cycles that focus on perimeter devices. Enterprises continue to treat SD-WAN controllers as lower-priority assets despite their role in routing encrypted traffic. Organizations must accelerate SD-WAN controller patching to under 30 days and deploy behavioral monitoring for process injection on control planes. Failure to address this class of vulnerability will leave persistent footholds intact ahead of any Indo-Pacific contingency.