Cisco SD-WAN Flaw Let Hackers Deploy KeyDrift Malware to Harvest Encryption Keys

Attackers exploited CVE-2026-20127, a CVSS 10.0 authentication-bypass flaw in Cisco Catalyst SD-WAN that was fixed in February, to plant custom malware called KeyDrift on SD-WAN control systems. Cisco Talos disclosed the campaign on October 28, describing the attacks as historical without specifying when they took place or whether any keys were exfiltrated. On a compromised Controller, KeyDrift reportedly collects key material for a preset list of edge routers, encrypts it and stores it, and can transmit it over UDP to a destination Talos could not determine. Researchers warn that organizations which were exposed before upgrading may still be affected, and Cisco has not said whether patching removes the malware. The flaw affects on-premises and Cisco-hosted SD-WAN deployments, and the group behind KeyDrift has reportedly targeted space, defense and policy research organizations.