Hackers install KeyDrift malware through Cisco SD-WAN vulnerability

First reported by The Hacker News at · Updated · 3 sources

The malware targets network controllers and is designed to copy traffic encryption keys for later use, according to Cisco Talos, as reported by The Hacker News. That report says the flaw was fixed in February. Cyber Security News identifies it as CVE-2026-20127, which allows attackers to bypass authentication and gain administrative access.

  • Cyber Security News reports a maximum CVSS severity score of 10.0.
  • Talos describes the attacks as historical without specifying dates, according to The Hacker News.

Covered by 3 publishers within 10 hours of the first report.

Reporting3

The Hacker News Hackers Exploited Cisco SD-WAN Flaw to Plant Malware Built to Steal Encryption Keys · info@thehackernews.com (The Hacker News)
Cyber Security News Hackers Exploit Critical Cisco SD-WAN 0-Day Flaw to Deploy KeyDrift Malware and Steal Encryption Keys · Tushar Subhra Dutta
BleepingComputer Hackers exploit Cisco SD-WAN flaw to deploy custom KeyDrift malware · Bill Toulas