Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ Network

What it is

Cisco Talos attributes exploitation of CVE-2026-20127 (CVSS 10, disclosed February 2026) to UAT-11473, a group it calls a highly sophisticated APT targeting space and satellite services, defense and aerospace technology, and policy research. Talos assessed with high confidence that the group's infrastructure "overlaps considerably with Volt Typhoon's 'Silent Train' covert access network." It does not say the two are the same group. Lumen's Black Lotus Labs published on Silent Train the same day, and its report does not mention KeyDrift or UAT-11473.

How it works

The flaw lets an unauthenticated remote attacker bypass peering authentication on SD-WAN controller components and obtain admin rights. Cisco warns this access can be used to alter the SD-WAN network's configuration.

KeyDrift is injected into legitimate control-plane processes, so it sees control traffic after decryption. It has two modules:

• PolyFlame: a backdoor that can also relay commands to other hosts as an intermediate C2 node.
• LittleFilch: collects keying material that Talos believes includes keys protecting data-plane traffic.

Silent Train routes operator traffic through chains of hacked small office routers, IoT devices and enterprise systems that are replaced often. The operators clean up after each session.

Preconditions / Affected

Cisco SD-WAN controller components exposed to the peering path are the target. Lumen says Volt Typhoon was exploiting CVE-2026-20127 by late 2025 and kept doing so long after Cisco's disclosure, so a patched-since-February system may still have been compromised earlier.

Lumen lists the platforms hit by confirmed zero-day campaigns: Versa Director, N-able N-central, Cisco Catalyst SD-WAN and VeloCloud Orchestrator. It lists Quest KACE as a likely one. Every campaign targeted management or control-plane systems with broad organizational reach.

Victims include telecoms, government entities, defense contractors, satellite and mission-critical communications providers, MSPs, universities with military ties, and critical infrastructure operators. Hawaii, California and Texas were targeted most. Lumen's monitoring has led to hundreds of victim notifications.

What to do

The page gives no patch version, indicators or detection queries. What it supports:

• Treat SD-WAN controllers, and the other management platforms listed above, as possibly compromised before February 2026, not only after.
• Because LittleFilch targets keys, a clean-up that removes the implant may not be enough. The page does not state remediation, but Talos believes data-plane keys may have been taken.
• Look to the Talos and Lumen reports for indicators, which this article does not reproduce.

Caveats

Talos calls the activity historical but has not said when the attacks occurred. The Talos link to Silent Train is an infrastructure overlap, not an identity. Lumen researcher Mike Horka told journalist Kim Zetter that the actors also exfiltrated documents on military operations and network structures, and he believes the activity combines pre-positioning and espionage. Lumen reads the victimology as an effort to secure footholds for a geopolitical crisis, particularly one involving the Indo-Pacific.