Hackers exploited a Cisco SD-WAN flaw to plant KeyDrift malware that steals encryption keys

Summary

Hackers exploited CVE-2026-20127, an authentication-bypass flaw in Cisco Catalyst SD-WAN Controllers that was fixed in February, to plant custom malware inside the systems that control an organization's SD-WAN network. The malware, called KeyDrift, is designed to copy the keys that encrypt traffic between sites and store them for later use. Cisco Talos said on October 28 that the attacks are historical but did not specify when they occurred. BleepingComputer reported that the activity is linked to a newly identified advanced persistent threat group it tracks as UAT-11473, which deployed KeyDrift as a custom malware framework.

Timeline

1. The Hacker News

   29 Oct 2026, 08:24 UTCSource ↗

   Hackers exploited a critical Cisco Catalyst SD-WAN flaw, fixed in February, to plant custom malware called KeyDrift that copies inter-site traffic encryption keys, according to Cisco Talos statements made on October 28.

2. BleepingComputer

   29 Oct 2026, 18:38 UTCSource ↗

   A newly identified APT group tracked as UAT-11473 exploited CVE-2026-20127, an authentication-bypass flaw in Cisco Catalyst SD-WAN Controllers, to deploy the custom KeyDrift malware framework.