# Cisco Catalyst SD-WAN Authentication Bypass (CVE-2026-20127) Exploited by UAT-8616 and Tied to Volt Typhoon's 'Silent Train' Network; UAT-11473 KeyDrift/PolyFlame/LittleFilch Toolset

> CVE-2026-20127 (CVSS 10.0) is an unauthenticated peering-authentication bypass in Cisco Catalyst SD-WAN Controller and Manager that yields administrative access; it was exploited as a zero-day (UAT-8616, since 2023 per ASD-ACSC) and, per Lumen Black Lotus Labs, by Volt Typhoon's 'Silent Train' covert network. Cisco Talos reports related UAT-11473 activity with infrastructure overlap to Silent Train, using the KeyDrift framework (PolyFlame, LittleFilch) to persist on SD-WAN controllers and harvest IPsec data-plane keying material.

- **Published:** 2026-10-29T11:02:16Z
- **Last reviewed:** 2026-10-29T18:49:09.005Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4729
- **ID:** TL-2026-4729
- **Severity:** CRITICAL (CVSS 10)
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** Volt Typhoon - G1017 (China)
- **Detections:** 9 · **IOCs:** 22 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-20127, CVE-2022-20775, CVE-2025-8875, CVE-2025-8876, CVE-2026-16812, CVE-2026-20122, CVE-2026-20128

## Description

CVE-2026-20127 is an authentication bypass in the peering authentication mechanism of Cisco Catalyst SD-WAN Controller (vSmart) and Manager (vManage). A remote, unauthenticated attacker sending crafted requests can log in as a high-privileged non-root user, enabling NETCONF manipulation and SD-WAN fabric configuration changes. Affected deployments include on-premises, Cisco Hosted SD-WAN Cloud, Cisco-managed hosted, and FedRAMP environments. Cisco disclosed the flaw on 2026-02-25/26 after the Australian Signals Directorate's ACSC discovered exploitation; Cisco Talos attributed the zero-day activity to UAT-8616, described as highly sophisticated and active since 2023. CISA issued Emergency Directive ED-26-03 and added CVE-2026-20127 and CVE-2022-20775 to the KEV catalog.

Observed post-exploitation chain (Cisco/CISA): after bypassing authentication, the actor exploited CVE-2022-20775 (CVSS 7.8, path traversal privilege escalation) after downgrading the software version to obtain root, created local accounts mimicking legitimate ones, added SSH authorized keys for root persistence, modified SD-WAN startup scripts, moved laterally in the management plane over NETCONF (port 830) and SSH, and purged logs, command history and connection records. Cisco advises auditing /var/log/auth.log for 'Accepted publickey for vmanage-admin' from IPs not matching configured System IPs; CISA directs review of /var/volatile/log/vdebug, /var/log/tmplog/vdebug and /var/volatile/log/sw_script_synccdb.log for version downgrades and unexpected reboots.

On 2026-10-28 Cisco Talos published analysis of UAT-11473, an APT cluster targeting space/satellite, defense and aerospace, and policy research organizations, with high-confidence infrastructure overlap with Volt Typhoon's Silent Train network. Its KeyDrift framework persists on SD-WAN controllers via modified runit service scripts (/etc/sv/sshd/, /etc/sv/aaamgr/), a packed statically linked aaamgrd loader (RC4), conf_sshd (PID enumeration) and rsshd (ptrace injector) that injects into vdaemon. PolyFlame (libdssl.so) is a memory-resident module hooking recvfrom, sendto, getpeername, dlopen, dlsym and mprotect to provide TinyShell-style command execution (0x100 exec, 0x200 file write, 0x300 file read) and intermediate C2 relay (0x403-0x408), with time-based activation derived from an MD5 of dates. LittleFilch (libcommon.so) hooks SSL_read in vdaemon to extract AES-256 IPsec data-plane keys, RSA-encrypts them and stages them in /var/tmp/vdaemon.bin, with endpoint configuration in /var/tmp/vdaemon.conf.

Lumen Black Lotus Labs (tracking Nov 2023 to Jul 2026) describes Silent Train as Volt Typhoon's operational framework, which emerged after the late-2023 KV-botnet disruption. Operators route from VPS (Alibaba, Huawei, Ucloud) through 4-6 hops of compromised non-US devices (Europe/Africa) and then US-based devices, using Chisel and FRP reverse proxies, in-memory webshells, credential harvesting and living-off-the-land tools. Besides CVE-2026-20127, the network exploited Versa Director, N-able N-central (CVE-2025-8875, CVE-2025-8876), VeloCloud Orchestrator (CVE-2026-16812) and a likely Quest KACE zero-day (30+ victims). Activity concentrates on weekdays 09:00-22:00 CST; Hawaii, California and Texas were most targeted, across telecom, government, defense contractors, MSPs, universities, and critical infrastructure. SecurityWeek (2026-10-29) reports Volt Typhoon exploited CVE-2026-20127 by late 2025 and continued long after the February 2026 disclosure. No network IOCs (IPs/domains/hashes) were published in the sources reviewed.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1601.002 Downgrade System Image
- T1136.001 Create Account: Local Account
- T1098.004 Account Manipulation: SSH Authorized Keys
- T1037 Boot or Logon Initialization Scripts
- T1543 Create or Modify System Process
- T1574.006 Hijack Execution Flow: Dynamic Linker Hijacking
- T1055.008 Process Injection: Ptrace System Calls
- T1036.004 Masquerading: Masquerade Task or Service
- T1685.006 Clear Linux or Mac System Logs
- T1070.003 Indicator Removal: Clear Command History
- T1070.006 Indicator Removal: Timestomp
- T1497.001 Virtualization/Sandbox Evasion: System Checks
- T1040 Network Sniffing
- T1021.004 Remote Services: SSH
- T1090.003 Proxy: Multi-hop Proxy
- T1573.001 Encrypted Channel: Symmetric Cryptography
- T1584.008 Compromise Infrastructure: Network Devices
- T1583.003 Acquire Infrastructure: Virtual Private Server
- T1078 Valid Accounts
- T1068 Exploitation for Privilege Escalation
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1027.002 Obfuscated Files or Information: Software Packing
- T1041 Exfiltration Over C2 Channel

## Sources

- [Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon's 'Silent Train' Network](https://www.securityweek.com/cisco-sd-wan-zero-day-exploitation-tied-to-volt-typhoons-silent-train-network/)
- [Cisco Talos: UAT-11473 and the KeyDrift framework](https://blog.talosintelligence.com/uat-11473-keydrift/)
- [Lumen Black Lotus Labs: Silent Train - Volt Typhoon operational framework](https://www.lumen.com/blog/en-us/silent-train-volt-typhoon-operational-framework)
- [Cisco Security Advisory cisco-sa-sdwan-rpa-EHchtZk](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk)
- [CISA Emergency Directive ED-26-03: Mitigate Vulnerabilities in Cisco SD-WAN Systems](https://www.cisa.gov/news-events/directives/ed-26-03-mitigate-vulnerabilities-cisco-sd-wan-systems)
- [Cisco Talos: UAT-8616 SD-WAN exploitation](https://blog.talosintelligence.com/uat-8616-sd-wan/)
- [Tenable: CVE-2026-20127 Cisco Catalyst SD-WAN Controller/Manager zero-day authentication bypass](https://www.tenable.com/blog/cve-2026-20127-cisco-catalyst-sd-wan-controllermanager-zero-day-authentication-bypass)
- [The Hacker News: Cisco SD-WAN Zero-Day CVE-2026-20127](https://thehackernews.com/2026/02/cisco-sd-wan-zero-day-cve-2026-20127.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4729