Lumen has issued critical recommendations for defending against the CVE-2026-20127 vulnerability in Cisco SD-WAN Catalyst Controller systems. The flaw, rated with a CVSS severity score of 10.0, allows authentication bypass in the control plane. Lumen advises reducing internet exposure for network-management systems, restricting administrative access, and prioritizing patches. Organizations should also preserve security telemetry and investigate unusual administrative activity, such as logins, API interactions, and configuration changes.
The vulnerability, exploited by the threat actor Volt Typhoon, was actively used by late 2025 and continued after Cisco disclosed it in February 2026. Cisco Talos reported that the actor, tracked as UAT-11473, deployed the KeyDrift framework to maintain access and collect sensitive keying information from control-plane processes. KeyDrift includes components like PolyFlame, a backdoor, and LittleFilch, which inspects decrypted control-plane buffers.
Lumen also described Silent Train, a relay framework that routes activity through compromised devices, including SOHO, IoT, and enterprise systems. While Talos attributes the CVE-2026-20127 campaign to UAT-11473, Lumen associates it with Volt Typhoon. Both reports highlight overlapping infrastructure and separate actor findings, underscoring the complexity of the threat landscape.