1-minute read
What a defender needs to know
Cisco Talos traced exploitation of CVE-2026-20127, a peering-authentication bypass in Cisco Catalyst SD-WAN control components, to UAT-11473. The actor installed KeyDrift in controller processes. Its LittleFilch module intercepted decrypted control messages and staged material Talos assesses as data-plane keys. Cisco reports limited exploitation; Talos describes targeting in space and satellite services, defense and aerospace technology, and policy research.
The flaw affects Controller, Manager and Validator across on-premises and Cisco-hosted deployments regardless of device configuration. An unauthenticated caller can obtain a privileged Controller identity and reach NETCONF to alter fabric configuration. Search /var/log/auth.log for Accepted publickey for vmanage-admin, compare source IPs with Manager WebUI > Devices > System IP, and validate control peers by timestamp, public IP, System IP and role against your topology and change history. The implant can communicate in-band, so a search for a fixed C2 address is a poor substitute for those checks.
Compare running releases with Cisco’s branch-specific first-fixed table and upgrade vulnerable control components. For customer-hosted systems, Cisco recommends temporary restrictions on ports 22 and 830 to known controller and authorized IPs; those restrictions do not fix the flaw. If peers or logins are unauthorized, inspect service launchers and KeyDrift artifacts, collect request admin-tech from each control component, and open a Cisco TAC case. A fixed build and authorized peer history are separate checks.