Volt Typhoon’s ‘Silent Train’ Rode Four Zero-Days Into Network Control

Lumen’s Black Lotus Labs says it has tracked a covert access network it calls Silent Train, run by China’s Volt Typhoon, since late 2023, and tied it to four zero-day campaigns against the tools companies use to manage their networks. In a new report, Lumen says its monitoring led to hundreds of victim notifications. The same week, Cisco Talos described custom malware that steals encryption keys from Cisco SD-WAN controllers and linked its operator’s infrastructure to Silent Train.

For defenders

The campaigns (per Lumen): N-able N-central, through a chain of then-undisclosed flaws (CVE-2025-8875 and CVE-2025-8876); Cisco Catalyst SD-WAN, through CVE-2026-20127, exploited by late 2025, months before Cisco disclosed it in February; VeloCloud Orchestrator, through a zero-day Lumen lists as CVE-2026-16812; and Quest KACE, where Lumen says with moderate confidence a zero-day was used against more than 30 victims but couldn’t pin down the flaw. All are T1190 (Exploit Public-Facing Application) against management and control-plane products.

How Silent Train moves: Sessions start on VPS outside the US and hop through hacked home routers, IoT and enterprise devices, up to six hops, T1090.003 (Proxy: Multi-hop Proxy). Lumen saw TP-Link, Netgear Orbi, FortiGate and Cisco devices in the chains, with Chisel and FRP tunnels and temporary SSH services that were removed afterward. Logs were wiped or altered in several cases, T1070 (Indicator Removal). Activity tracked China Standard Time office hours and paused over Chinese New Year. Lumen published no IP or hash indicators.

KeyDrift (per Talos): An actor Talos tracks as UAT-11473 exploited CVE-2026-20127, then injected a memory-resident module, PolyFlame, into the SD-WAN vdaemon process. A second component, LittleFilch (libcommon.so), hooks TLS reads to pull out peer addresses and what Talos assesses as IPsec data-plane key material, staging it in /var/tmp/vdaemon.bin. Talos rates the infrastructure overlap with Silent Train as high confidence and lists Snort rules for detection. Targets included space, satellite, defense and policy research organizations.

Targets: Lumen lists telecoms, US government, defense contractors, MSPs, universities with defense ties, and water, energy and transport operators. It reads the activity as pre-positioning for a future crisis.

What it means for you

This isn’t about stealing your files today. A state-backed group is quietly getting into the systems that run phone, power and water networks, and the software IT companies use to manage their customers, so it could cause disruption later. If an outside IT provider manages your computers, their management tools are exactly what these attackers go after.

Do this now

1. Patch management and SD-WAN platforms first, especially Cisco Catalyst SD-WAN for CVE-2026-20127, and follow Cisco’s hardening guide.
2. Take admin interfaces off the open internet; reach them only through a VPN, jump host or separate management network.
3. Keep logs from management systems somewhere attackers can’t edit them, and hunt for off-hours admin logins and remote file transfers.
4. Ask your MSP how its remote-management tools are patched and who can reach them.

Source article: Silent Train: uncovering Volt Typhoon’s operational framework for zero-day exploitation and strategic access
Publisher: Lumen Black Lotus Labs (analysis by Michael Horka; technical editing by Ryan English)
Published: no date shown on the page; covered by ThreatRoundup Oct. 28, 2026
URL: https://www.lumen.com/blog/en-us/silent-train-volt-typhoon-operational-framework

Executive Summary

Lumen Black Lotus Labs attributes a covert access network it names Silent Train to Volt Typhoon, the PRC state-sponsored actor, and Cisco Talos separately tracks an SD-WAN intrusion set as UAT-11473 whose infrastructure it assesses, with high confidence, overlaps considerably with Silent Train; Talos calls the malware framework KeyDrift. Lumen has watched Silent Train consistently since November 2023: sessions start on VPS outside the US, hop through compromised non-US SOHO and IoT devices, then through compromised US devices, about four nodes before US address space and one more before the target, up to six hops in all, across more than 27 device classes (including TP-Link, Netgear Orbi, Intelbras, Ruckus, Zyxel, Cambium, Fortinet FortiGate and Cisco). Operators exploit exposed web interfaces on those relays, stand up temporary SSH services and keys, and use Chisel and FRP reverse tunnels. Through this network the actor exploited management and control-plane products: Quest KACE (moderate-confidence zero-day, more than 30 victims, credentials harvested and exfiltrated), Versa Director (in-memory JAR web shell, reported in 2024), N-able N-central (CVE-2025-8875 and CVE-2025-8876), Cisco Catalyst SD-WAN (CVE-2026-20127, CVSS 10.0, exploited by late 2025) and VeloCloud Orchestrator (CVE-2026-16812). Post-exploitation included in-memory web shells, credential harvesting, abuse of native endpoint-control and file-transfer features, and log erasure or alteration. On Cisco SD-WAN controllers, Talos describes KeyDrift: a ptrace injector (rsshd, driven by the shell script conf_sshd) loads PolyFlame (libdssl.so) into vdaemon for in-band backdoor and relay tasking, and LittleFilch (libcommon.so) hooks SSL_read to capture peer addresses and assessed IPsec data-plane key material into /var/tmp/vdaemon.bin, with persistence through trojanized runit scripts and timestomping. Activity ran Monday to Friday, mostly 09:00 to 22:00 China Standard Time, and paused over Chinese New Year. Targets span telecoms, US government, defense, satellite communications, universities with military ties, MSPs and water, energy and transport operators; Lumen assesses the objective as long-term strategic access and pre-positioning. Neither vendor published IP, domain or hash indicators or rule text; Talos published Snort SIDs. Hunt leads, false-positive expectations and the available indicators are detailed below.

ATT&CK chain: Resource Development → Initial Access → Execution → Persistence → Privilege Escalation → Defense Evasion → Credential Access → Lateral Movement → Collection → Command and Control → Exfiltration

Hunt Lead Grid

Hunt Lead Level	Hunt Lead Name	ATT&CK	Risk of False Positives
1 (Junior)	KeyDrift Files on SD-WAN Controllers	T1055.008 (Process Injection: Ptrace System Calls), T1574.006 (Hijack Execution Flow: Dynamic Linker Hijacking)	Low. None of /tmp/system-vdaemon, /var/tmp/vdaemon.bin, /var/tmp/vdaemon.conf, libdssl.so, libcommon.so, rsshd or conf_sshd are part of a Cisco SD-WAN image as described by Talos, so the sweep anchors on exact paths and on libraries mapped into vdaemon that do not belong to the shipped image.
1 (Junior)	Trojanized runit Scripts for sshd and aaamgr	T1037 (Boot or Logon Initialization Scripts), T1036.004 (Masquerading: Masquerade Task or Service)	Low. Cisco upgrades change service scripts, so the check compares /etc/sv/sshd/ and /etc/sv/aaamgr/ run scripts against a known-good image of the same version and anchors on /rootfs.rw remounts, background launches and deleted PAM files, which upgrades do not add.
1 (Junior)	Snort Coverage for CVE-2026-20127 and KeyDrift	T1190 (Exploit Public-Facing Application)	Low to Medium. These are vendor-published signatures for one CVE and one malware set, but the rule text is not in the article, so tuning depends on the rule bodies in the Snort rule sets; legitimate controller peering on the same ports can produce noise if exploit-attempt rules are applied to trusted internal peers without context.
2 (Pro)	Reverse Tunnels and Ad Hoc SSH on Edge and Management Devices	T1572 (Protocol Tunneling), T1021.004 (Remote Services: SSH), T1090.003 (Proxy: Multi-hop Proxy)	Medium. Administrators and vendors do run SSH on non-standard ports and occasional tunnels, so the rule anchors on new listeners or outbound sessions from routers, firewalls and management appliances to cloud VPS ranges on ports such as 8999, 2222, 8103 and 14737, and on Chisel or FRP binaries, with an allowlist of approved jump hosts.
2 (Pro)	Timestomping and Log Gaps on Management Platforms	T1070.006 (Indicator Removal: Timestomp), T1070 (Indicator Removal)	Medium. Packaging and backup tools use touch --reference legitimately and log rotation creates gaps, so the detection anchors on reference-copying timestamps onto files in system or service directories of SD-WAN and management appliances, and on gaps in the appliance’s local log that do not appear in the forwarded copy.
3 (Elite)	Off-Hours Admin Sessions on Management Platforms From Relay Space	T1078 (Valid Accounts), T1190 (Exploit Public-Facing Application), T1505.003 (Server Software Component: Web Shell)	High without baselining. MSPs and global teams log in at all hours, so the detection needs per-account baselines of source network, hours and API use on N-central, KACE, SD-WAN Manager, VeloCloud and Versa, and alerts only on sessions from residential, SOHO or foreign VPS space that also show remote file transfer, script push or configuration change.

KeyDrift Files on SD-WAN Controllers

After exploiting the CVE-2026-20127 authentication bypass in Cisco Catalyst SD-WAN Controller instances, UAT-11473 deployed KeyDrift. The shell script conf_sshd enumerates the PIDs of running vdaemon processes and writes them to /tmp/system-vdaemon; the injector rsshd then uses ptrace to load PolyFlame (libdssl.so) into each vdaemon, where it interposes recvfrom, sendto, getpeername, dlopen, dlsym and mprotect and parses /proc/<pid>/maps. PolyFlame only activates when an MD5 of the device’s local date matches a value sent by the operator, and takes in-band tasking (run /bin/sh -c, read or write files, relay to peers). LittleFilch (libcommon.so) hooks SSL_read in vdaemon, filters for specific control-plane records, extracts transport IPs, peer system-IPs and a 32-byte field Talos assesses as AES-256 IPsec data-plane key material, and appends RSA-encrypted records to /var/tmp/vdaemon.bin; it reads its send-to configuration from /var/tmp/vdaemon.conf and deletes it, and can ship output over UDP in a DTLS-1.2-style record. A packed variant, aaamgrd, runs from the aaamgr service path and exits if TracerPid shows a debugger. The detection logic is a file sweep on every SD-WAN Manager, Controller (vSmart) and Validator for these paths and names, plus a check of each vdaemon process’s mapped libraries for anything that is not part of the shipped image.

Collect from the appliances through Cisco’s supported admin-tech or root-shell procedures (with TAC involvement if needed), not through ad hoc tooling that might itself alter evidence, and compare against a clean appliance of the same version. Because PolyFlame and LittleFilch are memory-resident inside vdaemon, a file sweep can miss them if the dropped libraries were removed; the mapped-library check and the presence of /var/tmp/vdaemon.bin (which grows as keys are captured) are the more durable anchors. Rebooting or patching first is the wrong order: it destroys the in-memory evidence, and the trojanized runit scripts Talos describes relaunch the chain when the services start again. Any hit is a confirmed compromise of the SD-WAN control plane: escalate to incident response, open a Cisco TAC case as Talos advises, and treat data-plane IPsec keys as exposed, which means planning key rotation across the fabric once the controllers are rebuilt.

Hunt Lead Level: 1 (Junior Analyst)

ATT&CK: Privilege Escalation / Defense Evasion → T1055.008 (Process Injection: Ptrace System Calls), T1574.006 (Hijack Execution Flow: Dynamic Linker Hijacking); Credential Access / Discovery → T1040 (Network Sniffing); mapping per source article (Talos).

Sources: “Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN”, Cisco Talos, Oct. 28, 2026, https://blog.talosintelligence.com/uat-11473-keydrift/ (additional source, same actor infrastructure per Talos’s high-confidence overlap with Silent Train)

Trojanized runit Scripts for sshd and aaamgr

Talos found persistence in the runit service supervision used on the controllers: run scripts under /etc/sv/sshd/ and /etc/sv/aaamgr/ were modified so that, when the service starts, they remount /rootfs.rw as executable and launch the KeyDrift chain (conf_sshd and the injector), masquerading as the legitimate SSH daemon and AAA manager services. The aaamgr launcher also deletes the writable-overlay PAM configuration files for sshd and login before the remount. The operators then used touch --reference= and chmod --reference= to copy timestamps and permissions from legitimate files onto their changes. The detection logic is an integrity check of every file under /etc/sv/sshd/ and /etc/sv/aaamgr/ against a clean image of the same software version, a search of those scripts for mount or remount of /rootfs.rw with exec, background launches (&, nohup) of unfamiliar binaries or scripts, and a check that the PAM files for sshd and login in the writable overlay are present and unchanged.

Do not trust file modification times on these appliances, since the actor timestomped; use content hashes against a golden image or Cisco’s own integrity verification where available. Run the check on every SD-WAN Manager, Controller and Validator, and repeat it after every upgrade, because an upgrade may not overwrite files in a writable overlay. Simply restarting the services is the wrong move, since that executes the trojanized script. A modified run script is an incident: preserve the appliance state, escalate, and rebuild from a clean image rather than editing the script back. Checking init and supervisor scripts against a golden image generalizes to any Linux-based network appliance an actor might implant.

Hunt Lead Level: 1 (Junior Analyst)

ATT&CK: Persistence → T1037 (Boot or Logon Initialization Scripts), T1543 (Create or Modify System Process); Defense Evasion → T1036.004 (Masquerading: Masquerade Task or Service); mapping per source article (Talos).

Sources: “Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN”, Cisco Talos, Oct. 28, 2026, https://blog.talosintelligence.com/uat-11473-keydrift/ (additional source, same actor infrastructure per Talos)

Snort Coverage for CVE-2026-20127 and KeyDrift

The entry point for the SD-WAN campaign, per both Lumen and Talos, is CVE-2026-20127, a CVSS 10.0 authentication bypass in Cisco Catalyst SD-WAN that Lumen says was exploited by late 2025, before Cisco’s February 2026 disclosure, and continued afterward against the control plane’s trusted peering. Talos lists Snort SIDs 65938 and 65958 for the vulnerability, and for the KeyDrift artifacts Snort 2 SIDs 67387 through 67416 and Snort 3 SIDs 7:44 through 7:73. The article does not include the rule bodies. The detection logic is to confirm these SIDs are present and enabled on any Snort-based or Cisco Secure Firewall sensor that can see traffic to and from SD-WAN Manager, Controllers and Validators (including management and control-plane interfaces, not only the internet edge), and to search historical IDS alerts for any of them back to at least mid-2025.

Check the rule bodies in the Snort Subscriber or LightSPD rule set for the protocols and ports they cover, and place sensors where they can see controller peering, which often crosses internal segments that edge IDS never inspects. Because the vulnerability rules key on exploit traffic, alerts from untrusted sources against controller interfaces should be escalated straight away; alerts between known controllers need context before tuning, but should not be suppressed wholesale, since the actor targeted trusted peering. The artifact SIDs that fire on traffic from a controller indicate an implant, which is an incident. Signatures do not replace patching: apply Cisco’s fixed releases and hardening guide, because the actor exploited the flaw before any signature existed.

Hunt Lead Level: 1 (Junior Analyst)

ATT&CK: Initial Access → T1190 (Exploit Public-Facing Application)

Sources: “Silent Train: uncovering Volt Typhoon’s operational framework for zero-day exploitation and strategic access”, Lumen Black Lotus Labs, https://www.lumen.com/blog/en-us/silent-train-volt-typhoon-operational-framework (source article); “Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN”, Cisco Talos, Oct. 28, 2026, https://blog.talosintelligence.com/uat-11473-keydrift/ (additional source; Snort SIDs)

Reverse Tunnels and Ad Hoc SSH on Edge and Management Devices

Silent Train relays are built by exploiting exposed web interfaces on routers, firewalls and appliances, then deploying temporary SSH services, keys and configuration files and the open-source proxies Chisel and FRP for reverse tunnels, which the operators remove afterward. Lumen’s examples show the shape on the wire: HTTPS on 443 and SSH on 2222 between cloud VPS providers with HTTP on 8281 returning; a Chisel reverse tunnel over TCP 8999 from a router to a VPS in Huawei Cloud; SSH on 22 and 8103 between VPS; and HTTPS on 8443 and SSH on 14737 into a compromised US router. Sessions are long, averaging about four hours by one measure and 8 to 10 hours by another in the same report. The detection logic is, on any router, firewall, VPN concentrator, SD-WAN edge or management appliance the organization owns, an alert for a new listening SSH service on a non-standard port, an outbound SSH or long-lived TCP session to cloud VPS address space, the presence of Chisel or FRP binaries or their configuration files, and new authorized_keys entries.

Use NetFlow or firewall logs for the network side (edge devices rarely run EDR), device configuration and file-system snapshots for the host side, and baselines of which ports each device normally listens on. Allowlist approved jump hosts and vendor support ranges by address, not by port. Blocking the ports named above is the wrong control on its own: the operators pick ports per relay, and Lumen’s numbers are examples, not a fixed set; detect new listeners and sessions instead. Because the SSH services are temporary, sweep flow data for short-lived listener activity going back as far as retention allows. A confirmed tunnel from an organization’s own device makes that device part of the relay network: escalate, preserve configuration and memory where possible, and replace or rebuild end-of-life hardware rather than patching it. Hunting for new tunnels and listeners on edge devices generalizes to other China-nexus covert networks built from compromised SOHO and IoT gear.

Hunt Lead Level: 2 (Pro)

ATT&CK: Command and Control → T1572 (Protocol Tunneling), T1090.003 (Proxy: Multi-hop Proxy); Lateral Movement → T1021.004 (Remote Services: SSH); Resource Development → T1584.008 (Compromise Infrastructure: Network Devices). Lumen lists no ATT&CK IDs; these are assigned from the behaviors it describes.

Sources: “Silent Train: uncovering Volt Typhoon’s operational framework for zero-day exploitation and strategic access”, Lumen Black Lotus Labs, https://www.lumen.com/blog/en-us/silent-train-volt-typhoon-operational-framework (source article)

Timestomping and Log Gaps on Management Platforms

Lumen says that in several cases the actor erased or altered logs and other evidence on compromised management platforms, without naming files or commands; Talos is specific for the SD-WAN implants, describing timestomping with touch --reference= and chmod --reference= so modified scripts and dropped files inherit timestamps and permissions from legitimate ones. The detection logic has two parts. On Linux-based appliances and management servers where shell history, auditd or EDR process telemetry exists, alert on touch or chmod with --reference (or touch -d/-t) targeting files under system, service or web directories. On every management platform (N-central, KACE, SD-WAN Manager, VeloCloud Orchestrator, Versa Director), compare the platform’s local audit and access logs against the copy already forwarded to a central log store, and alert on missing ranges, truncated files, or event counts that drop to zero during periods when the forwarded copy shows activity.

This only works if logs leave the appliance quickly, which is also Lumen’s main recommendation: centralize logging, extend retention and export telemetry. Tune the timestomp rule by excluding package managers and backup tooling by parent process and path. Log gaps also come from rotation, disk-full conditions and upgrades, so correlate a gap with maintenance windows before escalating. Trusting the appliance’s own logs after a suspected compromise is the wrong approach; investigate from the forwarded copy and from network telemetry. A timestomp on a service script, or a gap that lines up with an off-hours admin session (next lead), is an escalation. Detecting evidence removal by comparing local and forwarded logs generalizes to any actor that cleans up on appliances.

Hunt Lead Level: 2 (Pro)

ATT&CK: Defense Evasion → T1070.006 (Indicator Removal: Timestomp), mapping per Talos; T1070 (Indicator Removal), assigned from Lumen’s description of erased or altered logs (the source does not say which logs, so no sub-technique is assigned).

Sources: “Silent Train: uncovering Volt Typhoon’s operational framework for zero-day exploitation and strategic access”, Lumen Black Lotus Labs, https://www.lumen.com/blog/en-us/silent-train-volt-typhoon-operational-framework (source article); “Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN”, Cisco Talos, Oct. 28, 2026, https://blog.talosintelligence.com/uat-11473-keydrift/ (additional source)

Off-Hours Admin Sessions on Management Platforms From Relay Space

Across five campaigns the actor went after management and control-plane products (Quest KACE, Versa Director, N-able N-central, Cisco Catalyst SD-WAN, VeloCloud Orchestrator), then used in-memory web shells, harvested and exfiltrated credentials (KACE), and abused native endpoint-control and remote file-transfer features. Lumen’s timing data gives a behavioral anchor: activity ran Monday to Friday, mostly 09:00 to 22:00 China Standard Time (01:00 to 14:00 UTC, which is overnight and morning in the Americas), with sessions lasting hours and arriving through US residential, SOHO or cloud VPS addresses at the end of the relay chain. The detection logic correlates, per management platform, administrative logins or API sessions from source addresses outside the platform’s normal administrator networks (especially residential ISP, SOHO or VPS ranges), during hours outside that account’s baseline, with follow-on high-impact actions in the same session: remote file transfers, script or package pushes to managed endpoints, new admin accounts or API tokens, policy or configuration changes, and unusual new child processes of the platform’s web or application service that could indicate a web shell.

This needs detection engineering: per-account baselines of source networks, hours and action mix built from at least 30 days of platform audit logs, enrichment of source IPs with ASN and residential or hosting classification, and joins to EDR telemetry on the management server for web-service child processes. Sweep historical audit logs back as far as retention allows, since Lumen reports activity since late 2023 and Quest KACE exploitation that declined after October 2025 updates. MSP and follow-the-sun teams will match on hours alone, so the alert must require the unusual source network plus a high-impact action; blocking logins by time of day is the wrong control because it breaks legitimate support and the actor can shift hours. The better structural control, which Lumen also recommends, is removing internet exposure of admin interfaces in favor of VPN, jump hosts or a dedicated management network. A correlated hit on an MSP’s platform puts every downstream customer at risk: escalate immediately, revoke sessions and tokens, and review every push made in the window. Baselining admin behavior on management planes generalizes to any actor that targets them.

Hunt Lead Level: 3 (Elite)

ATT&CK: Initial Access → T1190 (Exploit Public-Facing Application); Persistence / Defense Evasion / Initial Access → T1078 (Valid Accounts); Persistence → T1505.003 (Server Software Component: Web Shell). Lumen lists no ATT&CK IDs; these are assigned from its description of zero-day exploitation, credential harvesting and in-memory web shells.

Sources: “Silent Train: uncovering Volt Typhoon’s operational framework for zero-day exploitation and strategic access”, Lumen Black Lotus Labs, https://www.lumen.com/blog/en-us/silent-train-volt-typhoon-operational-framework (source article)

Hash Appendix

KeyDrift components (PolyFlame, LittleFilch, rsshd, conf_sshd, aaamgrd)

Neither the source article nor the Talos article publishes file hashes, and Talos says no hardcoded network indicators were recovered from PolyFlame. With no hash in either source there was nothing to pivot on in OTX AlienVault or VirusTotal, so none are listed. Detect on paths, mapped libraries, runit script integrity and the Snort SIDs above.

MD5s

(not available)  # libdssl.so (PolyFlame), libcommon.so (LittleFilch), rsshd (injector), conf_sshd (script), aaamgrd (packed PolyFlame variant)

SHA1s

(not available)  # libdssl.so, libcommon.so, rsshd, conf_sshd, aaamgrd

SHA256s

(not available)  # libdssl.so, libcommon.so, rsshd, conf_sshd, aaamgrd

Silent Train relay tooling (Chisel, FRP)

Lumen publishes no hashes. Chisel and FRP are legitimate open-source tools; hashing their public releases would flag legitimate use and miss rebuilt copies, so detect on placement (edge and management devices), listeners and outbound sessions instead.

MD5s

(not available)  # Chisel, FRP (legitimate open-source proxies abused for reverse tunnels)

SHA1s

(not available)  # Chisel, FRP

SHA256s

(not available)  # Chisel, FRP

References Appendix

• “Silent Train: uncovering Volt Typhoon’s operational framework for zero-day exploitation and strategic access”, Lumen Black Lotus Labs, Michael Horka (analysis) and Ryan English (technical editing), no date shown on the page (covered Oct. 28, 2026), https://www.lumen.com/blog/en-us/silent-train-volt-typhoon-operational-framework (source article; relay architecture, campaigns, ports, operating hours, recommendations)
• “Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN”, Cisco Talos, Oct. 28, 2026, https://blog.talosintelligence.com/uat-11473-keydrift/ (KeyDrift components, file paths, ATT&CK mapping, Snort SIDs)
• Cisco Security Advisory for CVE-2026-20127, Cisco, https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk (patch reference, as linked by Talos)
• Cisco Catalyst SD-WAN Hardening Guide, Cisco, https://sec.cloudapps.cisco.com/security/center/resources/Cisco-Catalyst-SD-WAN-HardeningGuide (hardening reference, as linked by Talos)
• MITRE ATT&CK Enterprise technique pages linked above, MITRE, https://attack.mitre.org/

CVE at a glance

CVE-2026-20127CriticalKEVPublic exploitCisco Catalyst SD-WAN Controller and Manager

CVSS

10 Critical (v3.1)

EPSS

89.3% chance of exploitation in the next 30 days (higher than 99.7% of CVEs)

Exploited in the wild

Yes, on CISA’s KEV list since Feb 25, 2026

Public exploit

Yes, reported in a Metasploit module and 9 GitHub repositories

Full CVE details

Data from NVD, FIRST EPSS and CISA KEV, refreshed automatically. We report whether public exploit code exists but never link to it: fake proof-of-concepts that infect researchers are common.