UAT-8616

Mentions · 7d2
Mentions · 30d2
All mentions2
First seenOct 29, 2026
Last mentioned1d ago

Timeline

2 articles · newest first

Hackers exploit Cisco SD-WAN flaw to deploy custom KeyDrift malware

CVE-2026-20127, patched in February 2026, lets attackers add rogue peers and steal IPsec key material from controllers.

BleepingComputerupdated 00:10 UTC · 22h agofirst Oct 29, 18:38 UTC · 1d agoExploit / PoCExploited14 sourcesCVE-2026-201271

Cisco SD-WAN CVE-2026-20127 exploited to install KeyDrift key-stealing malware

The malware hooks vdaemon to copy AES-256 key material; Cisco calls exploitation limited and lists fixed trains.

The Hacker Newsupdated 00:10 UTC · 22h agofirst Oct 29, 08:24 UTC · 1d agoExploit / PoCExploited14 sourcesCVE-2026-20127

Related CVEs

by mentions

CVE-2026-2012789%10.0
Authentication Bypass in Cisco Catalyst SD-WAN Controller, Manager, Validator
published Feb 25, 2026Cisco Catalyst SD-WAN Controller (formerly SD-WAN vSmart)KEV

Appears with

Ciscovendor · 2
Catalyst SD-WAN Managerproduct · 2
LittleFilchmalware · 2
UAT-11473threat actor · 2
Catalyst SD-WAN Controllerproduct · 2
KeyDriftmalware · 2
Volt Typhoonthreat actor · 2
Cisco Talosorganization · 2
Lumenorganization · 2
PolyFlamemalware · 2
Silent Trainmalware · 1
NSAorganization · 1
CISAorganization · 1
Black Lotus Labsorganization · 1
Catalyst SD-WAN Validatorproduct · 1
FBIorganization · 1

Entities are extracted by the model from each article. First seen Oct 29, 2026, last mentioned 1d ago. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.