Hackers exploit CVE-2026-20127, an authentication-bypass flaw in Cisco Catalyst SD-WAN Controllers, to deploy a custom malware framework called KeyDrift, researchers reported. The advanced persistent threat group UAT-11473, linked to the Chinese Volt Typhoon state-sponsored group, has used the vulnerability as a zero-day since at least 2023. KeyDrift runs inside SD-WAN control-plane processes, intercepts decrypted control traffic, extracts a 32-byte AES-256 IPsec data-plane key field, and exfiltrates the material via encrypted UDP packets. Its two components, PolyFlame and LittleFilch, employ anti-debugging, process impersonation, and RSA encryption, storing data in /var/tmp/vdaemon.bin. Cisco patched CVE-2026-20127 in February 2026 and recommends that system administrators apply the security updates and consult the vendor’s hardening guide for Catalyst SD-WAN deployments. 1