Cisco SD-WAN flaw exploited to deploy KeyDrift malware

Cisco Talos says attackers exploited a critical Cisco Catalyst SD-WAN vulnerability to install KeyDrift, malware designed to collect encryption-key material from network controllers. Cisco has issued fixes, but Talos does not say whether collected keys were transmitted or whether upgrading removes malware from already-compromised systems.

• The vulnerability, CVE-2026-20127, allows an unauthenticated remote attacker to bypass authentication and gain administrative privileges; it has a CVSS score of 10.0.· 1 source
• Talos says KeyDrift can read decrypted control messages on a compromised Controller and extract what it assesses to be AES-256 key material. It could not recover the malware’s settings file, so it does not know whether the collected data was sent.· 1 source
• Cisco lists fixed software releases and advises customers to upgrade; Talos also recommends monitoring for post-compromise activity. The report does not establish whether upgrading removes KeyDrift from an already-compromised device.· 1 source