KeyDrift malware steals SD-WAN encryption keys from Cisco Catalyst SD-WAN controllers hacked through CVE-2026-20127 ยท updates https://pwn.watch/i/cisco-sd-wan-keydrift-uat-11473-cve-2026-20127 Cisco Talos said on Oct 28 2026 that an APT it tracks as UAT-11473 exploited CVE-2026-20127, the CVSS 10.0 authentication bypass in Cisco Catalyst SD-WAN Controller, Manager and Validator that Cisco fixed in February, and installed a custom malware framework called KeyDrift. Its PolyFlame module is injected into the controller's vdaemon processes as an in-memory backdoor and relay, and its LittleFilch module hooks SSL_read to pull AES-256 key material for a preset list of edge routers out of decrypted control traffic, staging it encrypted for exfiltration. Talos calls the activity historical, says targets included space and satellite services, defense and aerospace technology and policy research, and assesses with high confidence that the group's infrastructure overlaps with Volt Typhoon's Silent Train covert network. There is no workaround; upgrade to a fixed release and check controllers for compromise. en Wed, 28 Oct 2026 00:00:00 GMT KeyDrift malware steals SD-WAN encryption keys from Cisco Catalyst SD-WAN controllers hacked through CVE-2026-20127: Cisco Talos details KeyDrift, a malware framework UAT-11473 planted on SD-WAN controllers through CVE-2026-20127 to steal edge-router AES-256 key material, and releases Snort rules for its command-and-control traffic. https://pwn.watch/i/cisco-sd-wan-keydrift-uat-11473-cve-2026-20127 https://pwn.watch/i/cisco-sd-wan-keydrift-uat-11473-cve-2026-20127#2026-10-28-cb54e4b3 Wed, 28 Oct 2026 00:00:00 GMT critical <p><a href="https://blog.talosintelligence.com/uat-11473-keydrift/">Source</a></p> KeyDrift malware steals SD-WAN encryption keys from Cisco Catalyst SD-WAN controllers hacked through CVE-2026-20127: Lumen says Volt Typhoon was exploiting CVE-2026-20127 by late 2025 and kept exploiting it after Cisco's February disclosure, per The Hacker News. https://pwn.watch/i/cisco-sd-wan-keydrift-uat-11473-cve-2026-20127 https://pwn.watch/i/cisco-sd-wan-keydrift-uat-11473-cve-2026-20127#2026-10-28-8599233f Wed, 28 Oct 2026 00:00:00 GMT critical <p><a href="https://thehackernews.com/2026/10/hackers-exploited-cisco-sd-wan-flaw-to.html">Source</a></p> KeyDrift malware steals SD-WAN encryption keys from Cisco Catalyst SD-WAN controllers hacked through CVE-2026-20127: Cisco adds Catalyst SD-WAN Validator (formerly vBond) to the affected products in its advisory. https://pwn.watch/i/cisco-sd-wan-keydrift-uat-11473-cve-2026-20127 https://pwn.watch/i/cisco-sd-wan-keydrift-uat-11473-cve-2026-20127#2026-06-16-8e181098 Tue, 16 Jun 2026 00:00:00 GMT critical <p><a href="https://thehackernews.com/2026/10/hackers-exploited-cisco-sd-wan-flaw-to.html">Source</a></p> KeyDrift malware steals SD-WAN encryption keys from Cisco Catalyst SD-WAN controllers hacked through CVE-2026-20127: Cisco discloses CVE-2026-20127, a CVSS 10.0 peering authentication bypass in Catalyst SD-WAN Controller and Manager, as exploited in the wild; CISA adds it to KEV. https://pwn.watch/i/cisco-sd-wan-keydrift-uat-11473-cve-2026-20127 https://pwn.watch/i/cisco-sd-wan-keydrift-uat-11473-cve-2026-20127#2026-02-25-acba093e Wed, 25 Feb 2026 00:00:00 GMT critical <p><a href="https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk">Source</a></p>