Cisco SD‑WAN Flaw Exploited to Deploy KeyDrift Malware

# Cisco SD‑WAN Flaw Exploited to Deploy KeyDrift Malware

https://gcdradar.vercel.app/incidents/cisco-sd-wan-flaw-exploited-to-deploy-keydrift-malware · AIR-2026-1631 · closed 2026-11-12

- Lane: Breaches & attacks
- Severity: 3 (Confirmed exploitation): Exploited SD‑WAN flaw to steal encryption keys.
- Fix status: No fix needed
- First reported: 2026-10-29 (happened 2026-10-28)
- AI role: No AI role
- Products: Cisco Catalyst SD‑WAN
- CVE ids: CVE-2026-20127

## Summary

Hackers leveraged a critical Cisco Catalyst SD‑WAN vulnerability to install the KeyDrift malware that steals encryption keys. Although the flaw was patched in February, the attacks were observed historically.

## What to do

Search for KeyDrift malware on SD‑WAN devices and rotate compromised encryption keys.

## Latest updates

- 2026-10-29: APT group UAT-11473 observed exploiting the vulnerability to deploy KeyDrift malware (https://bleepingcomputer.com/news/security/hackers-exploit-cisco-sd-wan-flaw-to-deploy-custom-keydrift-malware)
- 2026-10-29: Hackers Exploited Cisco SD-WAN Flaw to Plant Malware Built to Steal Encryption Keys (https://thehackernews.com/2026/10/hackers-exploited-cisco-sd-wan-flaw-to.html)

## Sources

- 2026-10-29 The Hacker News: Hackers Exploited Cisco SD-WAN Flaw to Plant Malware Built to Steal Encryption Keys https://thehackernews.com/2026/10/hackers-exploited-cisco-sd-wan-flaw-to.html
- 2026-10-29 BleepingComputer: Hackers exploit Cisco SD-WAN flaw to deploy custom KeyDrift malware https://bleepingcomputer.com/news/security/hackers-exploit-cisco-sd-wan-flaw-to-deploy-custom-keydrift-malware

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.