KeyDrift

Mentions · 7d8
Mentions · 30d8
All mentions8
First seenOct 28, 2026
Last mentioned1d ago

Timeline

8 articles · newest first

Hackers exploit Cisco SD-WAN flaw to deploy custom KeyDrift malware

CVE-2026-20127, patched in February 2026, lets attackers add rogue peers and steal IPsec key material from controllers.

BleepingComputerupdated 00:10 UTC · 22h agofirst Oct 29, 18:38 UTC · 1d agoExploit / PoCExploited14 sourcesCVE-2026-201271

Volt Typhoon used rotating Silent Train relays for zero-days

Lumen says exploited products included Versa, N-able, Cisco SD-WAN, VeloCloud and possibly Quest KACE; KeyDrift hit Cisco controllers.

Help Net Securityupdated 00:10 UTC · 22h agofirst Oct 29, 13:42 UTC · 1d agoThreat actorExploited14 sourcesCVE-2024-39717 CVE-2025-8875 CVE-2025-8876+21

Cisco SD-WAN zero-day CVE-2026-20127 used to install KeyDrift

Talos says UAT-11473 stole suspected IPsec keys from space, defense, and policy targets; patches shipped in February 2026.

Cyber Security Newsupdated 00:10 UTC · 22h agofirst Oct 29, 13:30 UTC · 1d agoExploit / PoCExploited14 sourcesCVE-2026-20127 CVE-2026-201821

KeyDrift malware steals SD-WAN encryption keys via CVE-2026-20127

UAT-11473 uses a CVSS 10.0 auth bypass on Cisco Catalyst SD-WAN to plant in-process key stealers; fixes exist but no workaround.

GBHackersupdated 00:10 UTC · 22h agofirst Oct 29, 13:27 UTC · 1d agoMalwareExploited14 sourcesCVE-2026-201271

Cisco patches actively exploited ASA and FTD VPN crash flaw

CVE-2026-76418, scored 8.6, lets unauthenticated attackers reload firewalls when SSL VPN uses secondary authentication.

The Hacker Newsupdated 20:25 UTC · 1h agofirst Oct 29, 10:44 UTC · 1d agoExploit / PoCExploited10 sourcesCVE-2026-76418 CVE-2026-2012710 · 4 reads

Volt Typhoon-linked actor exploited Cisco SD-WAN zero-day to steal encryption keys

CVE-2026-20127 (CVSS 10) gives unauthenticated admin access to SD-WAN controllers; KeyDrift malware siphoned keying material and Volt Typhoon kept exploiting the flaw after disclosure.

SecurityWeekupdated 00:10 UTC · 22h agofirst Oct 29, 10:29 UTC · 1d agoExploit / PoCExploited14 sourcesCVE-2026-2012713 · 3 reads

Cisco SD-WAN CVE-2026-20127 exploited to install KeyDrift key-stealing malware

The malware hooks vdaemon to copy AES-256 key material; Cisco calls exploitation limited and lists fixed trains.

The Hacker Newsupdated 00:10 UTC · 22h agofirst Oct 29, 08:24 UTC · 1d agoExploit / PoCExploited14 sourcesCVE-2026-20127

UAT-11473 used Cisco SD-WAN auth bypass to plant KeyDrift

Talos says the implant lives in controller processes, steals data-plane keys, and overlaps Volt Typhoon infrastructure.

Cisco Talosupdated 00:10 UTC · 22h agofirst Oct 28, 21:32 UTC · 2d agoThreat actorExploited14 sourcesCVE-2026-201271

Related CVEs

by mentions

CVE-2026-2012789%10.0
Authentication Bypass in Cisco Catalyst SD-WAN Controller, Manager, Validator
published Feb 25, 2026Cisco Catalyst SD-WAN Controller (formerly SD-WAN vSmart)KEV
CVE-2026-2018292%10.0
Authentication Bypass in Cisco Catalyst SD-WAN Control Components
published May 14, 2026Cisco Catalyst SD-WAN Controller (formerly SD-WAN vSmart)KEV
CVE-2026-168122%10.0
OS Command Injection in Arista VeloCloud Orchestrator On-Prem
published Jul 27, 2026Arista VeloCloud Orchestrator On-PremKEV
CVE-2025-88753%9.4
Insecure Deserialization Code Execution in N-able N-central (KEV)
published Aug 14, 2025N-able N-centralKEV
CVE-2025-88764%9.4
OS Command Injection in N-able N-central Before 2025.3.1
published Aug 14, 2025N-able N-centralKEV
CVE-2026-76418<1%8.6
Unauthenticated DoS in Cisco ASA and FTD SSL VPN with secondary auth
published 2d agoCisco Secure Firewall Adaptive Security Appliance (ASA) SoftwareKEV
CVE-2024-397174%7.2
Unrestricted File Upload in Versa Networks Versa Director Exploited by Volt Typhoon
published Aug 22, 2024Versa Networks Versa DirectorKEV

Appears with

Ciscovendor · 8
Cisco Talosorganization · 8
UAT-11473threat actor · 8
Volt Typhoonthreat actor · 8
PolyFlamemalware · 7
LittleFilchmalware · 7
Catalyst SD-WAN Managerproduct · 3
Catalyst SD-WAN Controllerproduct · 3
Black Lotus Labsorganization · 3
UAT-8616threat actor · 2
Lumenorganization · 2
Cisco Catalyst SD-WANproduct · 2
Catalyst SD-WAN Validatorproduct · 2
Cisco SD-WAN Catalyst Controllerproduct · 1
Cisco Catalyst SD-WAN Controllerproduct · 1
FBIorganization · 1

Entities are extracted by the model from each article. First seen Oct 28, 2026, last mentioned 1d ago. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.