Changed since version 2

• The source set is now Talos [S1] and SecurityWeek [S2]. Claims sourced only to BleepingComputer or The Hacker News were removed or moved to open_questions.
• fixed_in changed to null. The February 2026 version claim is no longer supported by the sources in hand.
• Removed the defense and policy targeting claim from triage. It was unsupported by the current sources.
• Added the Volt Typhoon Silent Train infrastructure overlap [S1][S2].
• Added Talos KeyDrift artifact Snort SIDs 67387-67416 (v2) and 7:44-7:73 (v3) to the IPS hunt [S1].
• Added the vdaemon /bin/sh -c hunt, based on the vendor-stated command-execution function [S1]. Merged the remount and timestomping hunts into one.
• Removed the LittleFilch capture discrepancy gap. Only Talos remains, and it states data-plane keys [S1].
• Removed the Cisco hardening-guide citation. Peering restriction is now marked as an inference.
• Added an Eradicate section from the Talos artifacts [S1].

What happened

• UAT-11473 exploited CVE-2026-20127, an authentication bypass in Cisco Catalyst SD-WAN Controller instances [S1].
• Trojanized runit scripts remount /rootfs.rw as executable and launch conf_sshd. conf_sshd records vdaemon PIDs in /tmp/system-vdaemon and uses the rsshd injector to load PolyFlame (libdssl.so) [S1].
• A packed ELF aaamgrd runs from a malicious runit service under /etc/sv/aaamgr/ [S1].
• LittleFilch (libcommon.so) hooks SSL_read in vdaemon to steal data-plane keys. It RSA-encrypts them into /var/tmp/vdaemon.bin and can send them over UDP [S1].
• The implant can run commands through /bin/sh -c from vdaemon. The actor used touch and chmod --reference to timestomp files [S1].
• Talos reports that KeyDrift infrastructure overlaps with Volt Typhoon's Silent Train network [S1][S2].

Timeline

Detect

KeyDrift file and process artifacts · SD-WAN controller file integrity monitoring / process execution logs

index=* ("/var/tmp/vdaemon.bin" OR "/var/tmp/vdaemon.conf" OR "/tmp/system-vdaemon" OR "libdssl.so" OR "libcommon.so" OR "rsshd" OR "conf_sshd" OR "aaamgrd") | stats count min(_time) as first max(_time) as last by host, source

A hit means: A KeyDrift component or its key staging file is present on a controller [S1]. Treat it as probable compromise with possible key theft.

Staging and timestomping commands · Controller shell history / auditd execve

index=* (("rootfs.rw" ("remount" OR "mount")) OR "touch --reference=" OR "chmod --reference=") | table _time host user _raw

A hit means: Someone remounted the read-only root or copied file metadata, as UAT-11473 did [S1]. Check the hit against change records, and inspect the /etc/sv/ files it touched.

vdaemon spawning a shell · Controller process execution / auditd

index=* parent_process_name="vdaemon" (process_name="sh" OR "/bin/sh -c") | table _time host parent_process_name process _raw

A hit means: vdaemon ran a shell command, which matches the implant's 0x100 command-execution function [S1].

Talos Snort SIDs: exploitation and KeyDrift artifacts · Network IPS alerts

index=* signature_id=* | eval sid=tonumber(signature_id) | where sid=65938 OR sid=65958 OR (sid>=67387 AND sid<=67416) | stats count min(_time) as first max(_time) as last by src, dest, signature_id

A hit means: Traffic matched Talos signatures [S1]. SIDs 65938 and 65958 indicate CVE-2026-20127 exploitation. SIDs 67387-67416 (Snort v2) indicate KeyDrift artifacts. Snort v3 sensors use 7:44-7:73 instead. Check the controller for on-box artifacts.

Verify

• Inspect /etc/sv/*/run scripts on each controller, especially /etc/sv/sshd/run, for added mount, conf_sshd or background-launch lines [S1].
• The legitimate aaamgr is a Python package. A compiled ELF aaamgrd under /etc/sv/aaamgr/ is anomalous [S1].
• Check vdaemon process memory maps for injected libdssl.so or libcommon.so [S1].
• Look for /var/tmp/vdaemon.bin and /var/tmp/vdaemon.conf, and for outbound UDP from the controller [S1].
• Benign look-alikes: TAC or upgrade work may remount filesystems or edit service scripts, so confirm against the change ticket. File timestamps can be forged with --reference, so do not trust mtime alone [S1].

Scope

Affected

• Cisco Catalyst SD-WAN Controller components vulnerable to CVE-2026-20127 [S1]

Only if

• The attacker can reach SD-WAN controller peering [S1]

Not affected if

• Cisco's fix for CVE-2026-20127 is applied. A compromise before patching is still possible [S1].

Enumerate

• All SD-WAN controller, validator and manager instances, with versions and patch dates
• Exposure of controller peering and management interfaces to the internet or untrusted networks
• Control-connection peering events from unexpected peers
• Data-plane keys and edge devices served by any controller with artifacts
• Outbound UDP from controllers to unknown destinations

Contain

• Restrict controller peering and management access to known peers and admin networks. This follows from the reachability condition and is an inference, not source guidance.
• Before any reboot or reimage, preserve evidence: vdaemon process memory, /etc/sv/, /var/tmp/vdaemon.*, /tmp/system-vdaemon and shell history [S1]. A reboot loses the in-memory injection state, and this cannot be undone.
• Block outbound UDP from controllers except to known infrastructure. LittleFilch can exfiltrate over UDP [S1].
• Apply Cisco's fix for CVE-2026-20127. Patching does not remove an existing implant [S1].
• Keys already exfiltrated cannot be recalled. Plan their rotation (see Recover).

Eradicate

• Restore the trojanized runit run scripts, including /etc/sv/sshd/run, and remove the malicious /etc/sv/aaamgr/ service and the ELF aaamgrd [S1].
• Remove conf_sshd, rsshd, libdssl.so, libcommon.so, /tmp/system-vdaemon and /var/tmp/vdaemon.* [S1].
• Reimaging from known-good media is safer than file cleanup, because timestomping hides modified files [S1]. This is an inference.

Recover

• Before reconnecting a controller, confirm it is patched for CVE-2026-20127 and that its run scripts are clean [S1].
• Rotate data-plane keys and controller credentials, because LittleFilch steals keying material [S1]. Rotation is an inference; the sources give no rotation guidance.
• Afterwards, monitor for re-modification of /etc/sv/, /rootfs.rw remounts, new /var/tmp/vdaemon.bin files, vdaemon shell spawns, controller UDP egress and the Talos SIDs [S1].

Re-enter the loop when

• Cisco or Talos publishes network C2 indicators (IPs or domains) for KeyDrift.
• Cisco revises the CVE-2026-20127 advisory, the affected components or the fixed releases.
• Exploitation is reported against other SD-WAN components, such as Manager or Validator, or against edge devices.
• Any controller hits a hunt, or key material is found staged. Then widen scope to all edges using the affected keys.
• New reporting expands the Volt Typhoon / Silent Train linkage to additional targets or sectors [S2].

Debrief

• Record when each controller was patched, and set that against the first exploitation evidence.
• Record whether key material was staged or exfiltrated, and when rotation completed.
• Gap: the sources in hand state no fixed version number.
• Gap: the sources give no network C2 indicators.
• Gap: the sources give no exploitation start date or targeted sectors.

Detection coverage — checked automatically

Checked automatically 2026-10-31 19:00Z from public sources: 9 published, 18 nothing found, 0 not machine-checkable, 0 failed. "Nothing found" means the public source answered and had nothing, as of that moment; a feed covers only its newest posts. Re-checked daily.

Exposure queries — generated automatically

vuln:CVE-2026-20127

cpe:"cpe:/a:cisco:catalyst_sd-wan_manager"

product:"Catalyst Sd-wan Manager"

host.services: (software.product = "Catalyst Sd-wan Manager")

product:"Cisco Catalyst SD-WAN vdaemon"

cpe:"cpe:/a:cisco:sd-wan_vbond_orchestrator"

product:"Sd-wan Vbond Orchestrator"

host.services: (software.product = "Sd-wan Vbond Orchestrator")

cpe:"cpe:/a:cisco:sd-wan_vsmart_controller"

product:"Sd-wan Vsmart Controller"

host.services: (software.product = "Sd-wan Vsmart Controller")

http.title:"vManage"

http.html:"Cisco vManage"

http.html:"Catalyst SD-WAN Controller"

Internet-wide count, trend

Shodan's count of matching services on the whole internet, one point a day; the scope (your ranges) is never part of it. A count moves with Shodan's crawl as much as with patching, so read the direction, not the digit.

Banner spellings: a model read 8 from the NVD names and this card's text (former and marketing names, console titles); 3 matched something on Shodan and are shown above, the rest were dropped.

Scope every query in your own tool, never in a shared document: Shodan `net:<your_ranges>`, `org:"<your_org>"` or `hostname:<your_domain>` (or a Shodan Monitor network alert, which applies the scope for you); Censys `host.ip: <your_ranges>` or `host.dns.names: <your_domain>`. Then compare the banner version with the affected range. Generated automatically 2026-10-31 19:00Z from the CVE ids and NVD's CPE configurations, each Shodan query counted against Shodan itself; re-built daily with the coverage check.

Open questions

• What fixed release does Cisco name for CVE-2026-20127? Earlier drafts cited a February 2026 update from a source no longer in the thread.
• Which sectors were targeted? Earlier drafts cited defense and policy targets from sources not in this input.
• Do the Snort v3 IDs 7:44-7:73 map to gid:sid, and how do sensors log them?
• Are Manager and Validator components exploited, or only Controller instances?

Sources

• [S1] https://blog.talosintelligence.com/uat-11473-keydrift/ · Cisco Talos Blog
• [S2] https://www.securityweek.com/cisco-sd-wan-zero-day-exploitation-tied-to-volt-typhoons-silent-train-network/ · SecurityWeek

Public OSINT only. AI-generated by the pipeline; structure follows the DAIR model from Dynamic Incident Response (Joshua Wright). Published automatically once it crosses the publish bar.