Threat reportAPTTL-2026-4729
Cisco Catalyst SD-WAN Authentication Bypass (CVE-2026-20127) Exploited by UAT-8616 and Tied to Volt Typhoon's 'Silent Train' Network; UAT-11473 KeyDrift/PolyFlame/LittleFilch Toolset
Cisco Catalyst SD-WAN Authentication Bypass (CVE-2026-20127) (TL-2026-4729), also tracked as Silent Train, is a critical-severity advanced persistent threat campaign scored CVSS 10, first published 2026-10-29. It is attributed to Volt Typhoon - G1017 (China) with medium confidence, affects Cisco Catalyst SD-WAN Controller and Manager, references 7 CVEs (CVE-2026-20127, CVE-2022-20775, CVE-2025-8875), maps to 24 MITRE ATT&CK techniques (T1021.004, T1027.002, T1036.004), and is covered by 9 detection rules and 22 indicators of compromise.
- CVSS
- 10/10Critical
- CVEs
- 7Referenced vulnerabilities
- Techniques
- 24MITRE ATT&CK
- Actors
- 1Volt Typhoon - G1017
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 22Indicators of compromise
Key facts for TL-2026-4729
- Threat ID
- TL-2026-4729
- Also known as
- Silent Train, KeyDrift
- Severity
- CRITICAL
- CVSS
- 10 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- APT
- First published
- Last reviewed
- Attribution
- Volt Typhoon - G1017
- Attribution confidence
- MEDIUM
- Nation-state nexus
- China
- Motivation
- ESPIONAGE
- Target sectors
- government administration, defense, aerospace, satellite, telecoms, critical-infrastructure, education, managed-service-providers, policy-research
- Target regions
- united states of america, Hawaii, California, Texas, Indo-Pacific
- Detection rules
- 9
- Indicators of compromise
- 22
- Updates
- 2026-10-29 · 2 updates · revalidated 2× · latest source
Malware and tooling in Cisco Catalyst SD-WAN Authentication Bypass (CVE-2026-20127)
Malware and tooling: KeyDrift, LittleFilch, PolyFlame, tsh, Chisel, FRP - S1144
How Cisco Catalyst SD-WAN Authentication Bypass (CVE-2026-20127) works
CVE-2026-20127 (CVSS 10.0) is an unauthenticated peering-authentication bypass in Cisco Catalyst SD-WAN Controller and Manager that yields administrative access; it was exploited as a zero-day (UAT-8616, since 2023 per ASD-ACSC) and, per Lumen Black Lotus Labs, by Volt Typhoon's 'Silent Train' covert network. Cisco Talos reports related UAT-11473 activity with infrastructure overlap to Silent Train, using the KeyDrift framework (PolyFlame, LittleFilch) to persist on SD-WAN controllers and harvest IPsec data-plane keying material.
CVE-2026-20127 is an authentication bypass in the peering authentication mechanism of Cisco Catalyst SD-WAN Controller (vSmart) and Manager (vManage). A remote, unauthenticated attacker sending crafted requests can log in as a high-privileged non-root user, enabling NETCONF manipulation and SD-WAN fabric configuration changes. Affected deployments include on-premises, Cisco Hosted SD-WAN Cloud, Cisco-managed hosted, and FedRAMP environments. Cisco disclosed the flaw on 2026-02-25/26 after the Australian Signals Directorate's ACSC discovered exploitation; Cisco Talos attributed the zero-day activity to UAT-8616, described as highly sophisticated and active since 2023. CISA issued Emergency Directive ED-26-03 and added CVE-2026-20127 and CVE-2022-20775 to the KEV catalog.
Observed post-exploitation chain (Cisco/CISA): after bypassing authentication, the actor exploited CVE-2022-20775 (CVSS 7.8, path traversal privilege escalation) after downgrading the software version to obtain root, created local accounts mimicking legitimate ones, added SSH authorized keys for root persistence, modified SD-WAN startup scripts, moved laterally in the management plane over NETCONF (port 830) and SSH, and purged logs, command history and connection records. Cisco advises auditing /var/log/auth.log for 'Accepted publickey for vmanage-admin' from IPs not matching configured System IPs; CISA directs review of /var/volatile/log/vdebug, /var/log/tmplog/vdebug and /var/volatile/log/sw_script_synccdb.log for version downgrades and unexpected reboots.
On 2026-10-28 Cisco Talos published analysis of UAT-11473, an APT cluster targeting space/satellite, defense and aerospace, and policy research organizations, with high-confidence infrastructure overlap with Volt Typhoon's Silent Train network. Its KeyDrift framework persists on SD-WAN controllers via modified runit service scripts (/etc/sv/sshd/, /etc/sv/aaamgr/), a packed statically linked aaamgrd loader (RC4), conf_sshd (PID enumeration) and rsshd (ptrace injector) that injects into vdaemon. PolyFlame (libdssl.so) is a memory-resident module hooking recvfrom, sendto, getpeername, dlopen, dlsym and mprotect to provide TinyShell-style command execution (0x100 exec, 0x200 file write, 0x300 file read) and intermediate C2 relay (0x403-0x408), with time-based activation derived from an MD5 of dates. LittleFilch (libcommon.so) hooks SSL_read in vdaemon to extract AES-256 IPsec data-plane keys, RSA-encrypts them and stages them in /var/tmp/vdaemon.bin, with endpoint configuration in /var/tmp/vdaemon.conf.
Lumen Black Lotus Labs (tracking Nov 2023 to Jul 2026) describes Silent Train as Volt Typhoon's operational framework, which emerged after the late-2023 KV-botnet disruption. Operators route from VPS (Alibaba, Huawei, Ucloud) through 4-6 hops of compromised non-US devices (Europe/Africa) and then US-based devices, using Chisel and FRP reverse proxies, in-memory webshells, credential harvesting and living-off-the-land tools. Besides CVE-2026-20127, the network exploited Versa Director, N-able N-central (CVE-2025-8875, CVE-2025-8876), VeloCloud Orchestrator (CVE-2026-16812) and a likely Quest KACE zero-day (30+ victims). Activity concentrates on weekdays 09:00-22:00 CST; Hawaii, California and Texas were most targeted, across telecom, government, defense contractors, MSPs, universities, and critical infrastructure. SecurityWeek (2026-10-29) reports Volt Typhoon exploited CVE-2026-20127 by late 2025 and continued long after the February 2026 disclosure. No network IOCs (IPs/domains/hashes) were published in the sources reviewed.
MITRE ATT&CK techniques used in TL-2026-4729
Lateral Movement
T1021.004 Remote Services: SSH
Defense Evasion
T1027.002 Obfuscated Files or Information: Software Packing; T1036.004 Masquerading: Masquerade Task or Service; T1055.008 Process Injection: Ptrace System Calls; T1070.003 Indicator Removal: Clear Command History; T1070.006 Indicator Removal: Timestomp; T1497.001 Virtualization/Sandbox Evasion: System Checks
Persistence
T1037 Boot or Logon Initialization Scripts; T1098.004 Account Manipulation: SSH Authorized Keys; T1136.001 Create Account: Local Account; T1543 Create or Modify System Process
Credential Access
Exfiltration
T1041 Exfiltration Over C2 Channel
Execution
T1059.004 Command and Scripting Interpreter: Unix Shell
Privilege Escalation
T1068 Exploitation for Privilege Escalation
Initial Access
T1078 Valid Accounts; T1190 Exploit Public-Facing Application
Command and Control
T1090.003 Proxy: Multi-hop Proxy; T1573.001 Encrypted Channel: Symmetric Cryptography
stealth
T1574.006 Hijack Execution Flow: Dynamic Linker Hijacking
Resource Development
T1583.003 Acquire Infrastructure: Virtual Private Server; T1584.008 Compromise Infrastructure: Network Devices
defense-impairment
T1601.002 Downgrade System Image; T1685.006 Clear Linux or Mac System Logs
Affected products and versions in Cisco Catalyst SD-WAN Authentication Bypass (CVE-2026-20127)
- Cisco — Catalyst SD-WAN Controller and Manager
Vulnerable versions: Releases prior to 20.9; 20.9 before 20.9.8.2; 20.11-20.12 before 20.12.6.1; 20.12.5 before 20.12.5.3; 20.13-20.15 before 20.15.4.2; 20.16-20.18 before 20.18.2.1
Fixed in: 20.9.8.2; 20.12.6.1; 20.12.5.3; 20.15.4.2; 20.18.2.1 - Versa — Versa Director
Vulnerable versions: Not specified in sources - N-able — N-central
Vulnerable versions: Not specified in sources - Arista — VeloCloud Orchestrator
Vulnerable versions: Not specified in sources - Quest — KACE
Vulnerable versions: Not specified in sources
Remediation for Cisco Catalyst SD-WAN Authentication Bypass (CVE-2026-20127)
Patches
- Cisco Catalyst SD-WAN fixed releases per cisco-sa-sdwan-rpa-EHchtZk
- Patch CVE-2022-20775 (privilege escalation chained in attacks)
Immediate actions
- Upgrade Cisco Catalyst SD-WAN Controller/Manager to a fixed release (20.9.8.2, 20.12.6.1, 20.12.5.3, 20.15.4.2, 20.18.2.1) per Cisco advisory cisco-sa-sdwan-rpa-EHchtZk
- Audit /var/log/auth.log for 'Accepted publickey for vmanage-admin' from IPs not in configured System IPs
- Review /var/volatile/log/vdebug, /var/log/tmplog/vdebug and /var/volatile/log/sw_script_synccdb.log for software version downgrades and unexpected reboots
- Hunt for KeyDrift artifacts: /etc/sv/sshd/, /etc/sv/aaamgr/, /var/tmp/vdaemon.bin, /var/tmp/vdaemon.conf, /tmp/system-vdaemon, libdssl.so, libcommon.so
- Review local accounts and SSH authorized_keys on SD-WAN controllers for lookalike accounts and unknown keys
Workarounds
- No workarounds available per Cisco; restrict network access to SD-WAN control/management plane pending upgrade
Longer-term hardening
- Treat SD-WAN controllers, orchestrators and RMM/management platforms as Tier-0 assets with restricted management-plane exposure
- Rotate IPsec data-plane keying material and credentials on controllers suspected compromised
- Apply Cisco Talos Snort rules (v2 SIDs 67387-67416, v3 SIDs 7:44-7:73, CVE SIDs 65938, 65958)
- Monitor for Chisel/FRP reverse proxy use and anomalous outbound tunnels from management infrastructure
CVEs associated with Cisco Catalyst SD-WAN Authentication Bypass (CVE-2026-20127)
CVE-2026-20127, CVE-2022-20775, CVE-2025-8875, CVE-2025-8876, CVE-2026-16812, CVE-2026-20122, CVE-2026-20128
Weaknesses (CWE) in Cisco Catalyst SD-WAN Authentication Bypass (CVE-2026-20127)
Timeline of Cisco Catalyst SD-WAN Authentication Bypass (CVE-2026-20127)
- Black Lotus Labs begins tracking Volt Typhoon's Silent Train network (late 2023, month precision) following the disruption of the KV-botnet; UAT-8616 is also assessed by ASD-ACSC to have compromised Cisco SD-WANs since 2023.
- Volt Typhoon exploits CVE-2026-20127 by late 2025 (month precision) per SecurityWeek reporting of Lumen/Talos findings.
- Cisco publishes advisory cisco-sa-sdwan-rpa-EHchtZk, Talos attributes exploitation to UAT-8616, and CISA issues Emergency Directive ED-26-03 adding CVE-2026-20127 and CVE-2022-20775 to KEV.
- Cisco disclosure date cited by The Hacker News; CISA ED-26-03 inventory deadline for federal agencies (11:59 p.m. ET).
- CISA emergency patching deadline of 5:00 PM ET for federal agencies under ED-26-03.
- Cisco advisory update confirms in-the-wild exploitation of CVE-2026-20122 and CVE-2026-20128 in Catalyst SD-WAN.
- CISA ED-26-03 detailed assessment due from federal agencies.
- CISA ED-26-03 hardening completion deadline for federal agencies.
- End of the Black Lotus Labs Silent Train tracking window (July 2026, month precision), covering hundreds of victim notifications.
- Cisco updates advisory cisco-sa-sdwan-rpa-EHchtZk to version 2.1 and adds Snort SIDs covering KeyDrift.
- Cisco Talos publishes UAT-11473 / KeyDrift analysis (PolyFlame, LittleFilch) with high-confidence infrastructure overlap with Silent Train.
- SecurityWeek reports CVE-2026-20127 exploitation tied to Volt Typhoon's Silent Train network, continuing long after the February disclosure.
Update history for TL-2026-4729
- 2026-10-29 — UAT-11473 Exploits Cisco Catalyst SD-WAN Authentication Bypass (CVE-2026-20127) to Deploy KeyDrift Key-Theft Malware (PolyFlame, LittleFilch): What changed No severity, exploitability or status change; the existing values (CRITICAL, ACTIVE, CVSS 10.0) already match the newer report. New indicators (1) 1 new tool indicator (TinyShell, the PolyFlame backdoor model). The report's /et
- 2026-10-29 — Cisco Catalyst SD-WAN Authentication Bypass (CVE-2026-20127) Exploited by UAT-11473 to Deploy KeyDrift Malware: What changed No change to severity (CRITICAL), exploitability (ACTIVE), status or attribution; record is enriched with additional technical detail. New indicators (2) 2 behavioral indicators: 'Accepted publickey for vmanage-admin' auth.log
Sources cited for Cisco Catalyst SD-WAN Authentication Bypass (CVE-2026-20127)
- Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon's 'Silent Train' Network
- Cisco Talos: UAT-11473 and the KeyDrift framework
- Lumen Black Lotus Labs: Silent Train - Volt Typhoon operational framework
- Cisco Security Advisory cisco-sa-sdwan-rpa-EHchtZk
- CISA Emergency Directive ED-26-03: Mitigate Vulnerabilities in Cisco SD-WAN Systems
- Cisco Talos: UAT-8616 SD-WAN exploitation
- Tenable: CVE-2026-20127 Cisco Catalyst SD-WAN Controller/Manager zero-day authentication bypass
- The Hacker News: Cisco SD-WAN Zero-Day CVE-2026-20127
Detection coverage for TL-2026-4729
As of 2026-10-29, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4729 across Splunk SPL, Microsoft KQL and Sigma, covering 22 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.