# Cisco SD-WAN Vulnerability Exploited to Deploy KeyDrift Malware

*Published October 30, 2026*
*Source: [https://thehackernews.com/2026/10/hackers-exploited-cisco-sd-wan-flaw-to.html](https://thehackernews.com/2026/10/hackers-exploited-cisco-sd-wan-flaw-to.html)*

## Executive Summary

*This is a Premium edition. The Executive Summary is available to sec-news.ai members —*
*[read it here](https://www.sec-news.ai/news/cisco-sd-wan-vulnerability-exploited-to-deploy-keydrift-malware) or [see plans](https://www.sec-news.ai/pricing).*

## Article

A significant vulnerability in Cisco's Catalyst SD-WAN has been exploited to deploy custom malware known as KeyDrift. This flaw, identified as CVE-2026-20127, was addressed by Cisco in February. However, state-linked threat actors have used it to compromise the systems that manage SD-WAN networks. KeyDrift is capable of intercepting and storing encryption keys, which poses a substantial risk to network confidentiality.

Cisco Talos revealed that the attackers leveraged KeyDrift to access and extract AES-256 encryption keys from compromised Controllers, formerly known as vSmart. This malware uses a component named LittleFilch to tap into decrypted control messages, collecting critical data from edge routers. The collected data is encrypted using RSA and stored for potential transmission to a remote server, although the configuration file for this has not been recovered.

The group behind these attacks, tracked as UAT-11473, has targeted sectors such as space and satellite services, defense technology, and policy research. There is a noted overlap with infrastructure used by Silent Train, a network of compromised devices linked to the Chinese state-sponsored group Volt Typhoon.

Cisco's advisory notes that the vulnerability impacts both on-premises systems and cloud deployments, affecting the SD-WAN Controller, Manager, and Validator. While Cisco has released patches, it advises customers to limit access to certain ports as a temporary measure. Organizations are urged to install these updates and monitor for signs of compromise, as the flaw remains a critical security concern. The absence of a workaround and the potential persistence of exploits necessitate immediate action from affected entities.