Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ Network

Cisco Talos has disclosed that a group tracked as UAT-11473 exploited CVE-2026-20127, a maximum-severity (CVSS 10) flaw in Cisco Catalyst SD-WAN, to install a malware toolkit called KeyDrift on controller systems. The bug lets unauthenticated remote attackers bypass peering authentication and gain admin control, which can then be used to tamper with the SD-WAN configuration. Talos found KeyDrift's PolyFlame backdoor and LittleFilch key-harvesting module embedded in legitimate control-plane processes to intercept decrypted traffic and steal encryption keys, and assessed with high confidence that the attacker's infrastructure overlaps with Volt Typhoon's 'Silent Train' covert proxy network. Separately, Lumen's Black Lotus Labs confirmed Volt Typhoon abused the same vulnerability as a zero-day from late 2025 onward, part of a pattern of attacks also hitting Versa Director, N-able N-central and VeloCloud Orchestrator, hitting telecoms, government, defense, satellite and critical-infrastructure targets largely in Hawaii, California and Texas.