CVE-2026-20127: Testing Cisco SD-WAN Controller Exposure and Proving KeyDrift Persistence

TL;DR

CVE-2026-20127 is an authentication bypass in the Cisco SD-WAN Catalyst Controller that UAT-11473 used to reach management functionality and deploy a framework Talos tracks as KeyDrift. Patching closes the entry path; it does not tell you whether anyone used it while it was open. The test has two halves: prove whether the unauthenticated path was reachable on your controllers, then hunt for injection evidence inside vdaemon and the runit service scripts that start it. Because the implant carries no hardcoded C2 address and gates execution on a date hash, a clean egress log is not evidence of anything — the proof is on the controller.

What this is

CVE-2026-20127 is an authentication bypass (CWE-287) affecting Cisco SD-WAN Catalyst Controller instances. In practice an unauthenticated request can reach management functionality that should require a session — the difference between an appliance on your edge and an appliance an outsider can configure.

KeyDrift is the half that makes this a testing problem rather than a patching problem. Talos describes a multi-component framework built to live inside the controller's own control-plane processes: PolyFlame, a memory-resident module injected into vdaemon, and LittleFilch, a collection module that hooks SSL_read to lift keying material out of decrypted control messages. Talos assesses the framework for long-term residence and automated exfiltration of sensitive keying material, and notes infrastructure overlap with Volt Typhoon's "Silent Train" network.

For a researcher that splits into two hypotheses with separate tests: was the bypass reachable here, and is something still resident in the control plane.

Why it matters

Anyone running an internet-reachable SD-WAN controller is in scope — including the DR pair nobody patched, the staging controller in a lab VLAN with a public IP, and every tenant on a managed controller.

What fails if you only handle the first half:

• Patch-only response. Talos' write-up covers historical activity. A controller patched last week may have been resident for months.
• Endpoint detection. There is no dropper or conventional beacon. PolyFlame is injected into a legitimate daemon and interposes normal socket and dynamic-linker calls.
• IOC blocklists. No hardcoded IPv4 address, callback domain, URL, host header, or polling interval was recovered from the analyzed samples. The implant learns its C2 address from live control traffic.
• Blast radius. What gets collected is control-plane keying material for edge nodes. The compromise does not stop at the controller, and a controller used as an intermediate C2 host is a foothold into partner and tenant networks.

How it works

The chain Talos documents runs through the controller's own service supervisor, not through a dropped binary in /tmp. In the observed sshd deployment, the actor edits the runit service run script so it remounts /rootfs.rw executable and backgrounds a script named conf_sshd before starting the legitimate service. That script enumerates running vdaemon PIDs into /tmp/system-vdaemon and calls an injector, rsshd, which loads PolyFlame (libdssl.so) into each process. A parallel variant replaces the aaamgrd launcher so the packed loader executes directly.

Once resident, PolyFlame hooks recvfrom, sendto, getpeername, dlopen, dlsym, and mprotect, and parses /proc/%d/maps — giving in-band tasking over SD-WAN control traffic instead of a conventional beacon. Tasking is gated: the C2 sends the MD5 of a specific date, and if the device's local %Y-%m-%d hash does not match, execution stops. That single design decision is why dormancy looks identical to cleanliness.

Cisco's advisory carries the affected release matrix for CVE-2026-20127, and both the Talos analysis and the NVD record link back to it (see Sources). Record the exact build number from each controller and reconcile it against that matrix — treat "we're on a supported train" as unverified until the number is written down.

Validation steps for the bypass half:

1. Fingerprint the controller unauthenticated and record build, org, and any version metadata the login surface exposes.
2. Stand up or borrow a patched controller of the same major release as a reference.
3. Replay the bypass request against non-production first, with identical headers, and capture the full transcript: request line, headers, status, body length, and a hash of the body.
4. Compare against the patched reference. If an authenticated-only JSON document — tenant list, device inventory, config fragment — returns with no session, that response is the finding.

Detection and response

Telemetry that still works when there is no fixed C2 address to pivot on:

• Service script integrity. Hash the runit service run scripts for sshd and aaamgrd and diff them against a known-good controller of the same release. Look for the /rootfs.rw remount and a backgrounded conf_sshd.
• Injection artifacts. A /tmp/system-vdaemon file holding a PID list is not normal. Enumerate loaded libraries inside vdaemon and look for a libdssl.so mapping or anonymous executable regions.
• Package integrity. A packed loader masquerading as aaamgrd will not match the package hash; verify binaries against the image rather than the filesystem timestamp.
• PAM configuration drift. The launcher manipulates writable-overlay PAM configuration for sshd and login around the remount — compare those files to the release baseline.
• Network. Talos published Snort SIDs for CVE-2026-20127 exploitation attempts, and separate rule sets for the post-exploitation artifacts. Those cover the attempt; they do not cover a dormant implant.
• Time-gated dormancy. Because PolyFlame exits when the date hash does not match, a controller with no outbound anomaly is not cleared. Absence of tasking is not absence of code.

What to do

1. Enumerate every controller — vManage-class, vSmart-class, vBond-class — including DR, staging, lab, and every tenant boundary on managed instances. Write down build number, owner, and internet reachability.
2. Reconcile builds against the advisory matrix from Cisco and NVD. Record the result; do not infer it.
3. Test the pre-auth surface on a non-production instance with a patched reference for comparison, and save the raw HTTP transcript.
4. Baseline the control plane: hashes of the runit service scripts, the aaamgrd and sshd binaries, PAM files, and the loaded-library set of vdaemon. Keep the baseline off the controller.
5. Hunt the injection chain on every controller reachable during the exposure window: /tmp/system-vdaemon, libdssl.so in memory maps, the conf_sshd script, /rootfs.rw remount state.
6. Treat keying material as exposed if any artifact lands. Rotate trust anchors and assess which edge nodes' keys were in scope.
7. Package the evidence so a second researcher can reproduce it: transcript, file hashes, the memory-map line, and the timestamp window. A screenshot of a scanner verdict is not a finding.
8. Re-test after remediation on the same controller, not on a similar one.

FAQ

Does patching CVE-2026-20127 remove KeyDrift? No. The patch closes the authentication bypass. The implant lives in modified service scripts and injected memory, and survives independently of the entry vector.

Why don't IOC feeds catch this? Talos recovered no hardcoded IPv4 addresses, callback domains, URLs, host headers, or polling interval from analyzed PolyFlame samples. The C2 address is learned from live control traffic, and tasking only proceeds when the date hash matches.

Which controllers are in scope? All of them, including the ones you assume are internal. Reachability is a routing fact, not a policy statement, and multi-tenant controllers extend scope to every tenant.

What is the single most useful artifact? A hash diff of the sshd runit service script plus a libdssl.so mapping inside vdaemon. Together they show both the persistence mechanism and the resident module.

Is a clean firewall log enough to close this out? No. The implant is designed for in-band control over SD-WAN traffic with no fixed external beacon, and it stops executing when the date check fails. A quiet log is consistent with both "not compromised" and "not currently tasked."

Can I safely test the bypass on production? Use a non-production controller and a patched reference. If you must test production, capture request and response hashes rather than dumping configuration contents, and agree the window with the owner beforehand.

Sources

• Cisco Talos, Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN — https://blog.talosintelligence.com/uat-11473-keydrift/
• NVD entry for CVE-2026-20127 (carries the Cisco advisory reference and affected release matrix) — https://nvd.nist.gov/vuln/detail/CVE-2026-20127
• Cisco Security Advisories publication listing — https://sec.cloudapps.cisco.com/security/center/publicationListing.x
• OWASP Web Security Testing Guide, authentication testing — https://owasp.org/www-project-web-security-testing-guide/
• Trusteed on validation and exploitability context — https://trusteed.io