View Ridge Security
Back to Cyber Hose

UAT-11473 exploits CVE-2026-20127, deploys KeyDrift on Cisco SD-WAN

A CVSS 10.0 Cisco SD-WAN authentication bypass is under active exploitation by APT UAT-11473 to deploy KeyDrift malware, targeting defense and aerospace.

🚨 ACTIVE EXPLOITATION

  • Talos: UAT-11473 APT exploited CVE-2026-20127 to deploy KeyDrift malware on Cisco SD-WAN controllers CVE-2026-20127 Cisco Talos identified APT actor UAT-11473 exploiting CVE-2026-20127 in Cisco SD-WAN Catalyst Controllers to deploy the KeyDrift malware framework.
    • Affects Cisco SD-WAN Catalyst Controller instances; CVE-2026-20127 is a CVSS 10.0 authentication bypass (CWE-287) used for initial access.
    • Targets include space and satellite services, defense and aerospace, and policy research organizations.
    • KeyDrift persists inside SD-WAN control-plane processes, intercepting decrypted control traffic and extracting keying material for encrypted exfiltration.
    • PolyFlame, the primary module, is injected into vdaemon processes via modified runit service paths and acts as a TinyShell-style backdoor and intermediate C2.
    • The LittleFilch module hooks SSL_read in vdaemon to harvest keying material for predefined edge nodes; Talos assesses with high confidence the infrastructure overlaps with Volt Typhoon's 'Silent Train' network. 📄 Source: sec.cloudapps.cisco.com · 📎 Coverage: blog.talosintelligence.com · 👁 via Cisco Talos

🕵️ RESEARCH & DEEP DIVES

  • XML Signature Wrapping auth bypass in Moldova's MPass SAML library, fixed in 10.0.4 Moldova's Egov.Integrations.MPass.Saml NuGet library allowed SAML authentication bypass via XML Signature Wrapping before version 10.0.4.
    • Affects ASP.NET Core relying parties using Moldova eGovernment Agency's Egov.Integrations.MPass.Saml package; all versions before 10.0.4 are vulnerable (8.0.53-8.0.56, 10.0.2), fixed in 10.0.4 and 10.0.5.
    • The library verified XML signatures without binding the signed reference to the trusted response root element, permitting CWE-347 signature verification bypass (CAPEC-475 signature spoofing).
    • An attacker holding any validly signed MPass SAML message (e.g. from their own login) can wrap it with attacker-chosen assertion content and authenticate as an arbitrary user, including privileged accounts.
    • Proposed severity: Critical, CVSS 3.1 9.1; found by Serghei Zagaiciuc via decompilation, independently confirmed by Maxim Masiutin; CVE ID request pending (CAN-2026-2041077). 📎 Coverage: masiutin.net · 👁 via r/netsec

Need help assessing your exposure?

Start with the free Posture Self-Check to see where you stand against the current threat landscape.

Free Posture Self-Check