Cisco SD-WAN zero-day exploited through network tied to Volt Typhoon’s Silent Train

Attackers exploited the critical Cisco SD-WAN vulnerability CVE-2026-20127 to obtain unauthenticated remote access and administrator privileges on SD-WAN controllers. Cisco Talos reported that KeyDrift malware was planted on controllers to maintain persistent access and collect keying material. UAT-11473 infrastructure overlapped considerably with Volt Typhoon’s Silent Train network, but Talos did not say that they are the same group.