PolyFlame

Mentions · 7d7
Mentions · 30d7
All mentions7
First seenOct 28, 2026
Last mentioned1d ago

Timeline

7 articles · newest first

Hackers exploit Cisco SD-WAN flaw to deploy custom KeyDrift malware

CVE-2026-20127, patched in February 2026, lets attackers add rogue peers and steal IPsec key material from controllers.

BleepingComputerupdated 00:10 UTC · 22h agofirst Oct 29, 18:38 UTC · 1d agoExploit / PoCExploited14 sourcesCVE-2026-201271

Cisco SD-WAN zero-day CVE-2026-20127 used to install KeyDrift

Talos says UAT-11473 stole suspected IPsec keys from space, defense, and policy targets; patches shipped in February 2026.

Cyber Security Newsupdated 00:10 UTC · 22h agofirst Oct 29, 13:30 UTC · 1d agoExploit / PoCExploited14 sourcesCVE-2026-20127 CVE-2026-201821

KeyDrift malware steals SD-WAN encryption keys via CVE-2026-20127

UAT-11473 uses a CVSS 10.0 auth bypass on Cisco Catalyst SD-WAN to plant in-process key stealers; fixes exist but no workaround.

GBHackersupdated 00:10 UTC · 22h agofirst Oct 29, 13:27 UTC · 1d agoMalwareExploited14 sourcesCVE-2026-201271

Cisco patches actively exploited ASA and FTD VPN crash flaw

CVE-2026-76418, scored 8.6, lets unauthenticated attackers reload firewalls when SSL VPN uses secondary authentication.

The Hacker Newsupdated 20:25 UTC · 1h agofirst Oct 29, 10:44 UTC · 1d agoExploit / PoCExploited10 sourcesCVE-2026-76418 CVE-2026-2012710 · 4 reads

Volt Typhoon-linked actor exploited Cisco SD-WAN zero-day to steal encryption keys

CVE-2026-20127 (CVSS 10) gives unauthenticated admin access to SD-WAN controllers; KeyDrift malware siphoned keying material and Volt Typhoon kept exploiting the flaw after disclosure.

SecurityWeekupdated 00:10 UTC · 22h agofirst Oct 29, 10:29 UTC · 1d agoExploit / PoCExploited14 sourcesCVE-2026-2012713 · 3 reads

Cisco SD-WAN CVE-2026-20127 exploited to install KeyDrift key-stealing malware

The malware hooks vdaemon to copy AES-256 key material; Cisco calls exploitation limited and lists fixed trains.

The Hacker Newsupdated 00:10 UTC · 22h agofirst Oct 29, 08:24 UTC · 1d agoExploit / PoCExploited14 sourcesCVE-2026-20127

UAT-11473 used Cisco SD-WAN auth bypass to plant KeyDrift

Talos says the implant lives in controller processes, steals data-plane keys, and overlaps Volt Typhoon infrastructure.

Cisco Talosupdated 00:10 UTC · 22h agofirst Oct 28, 21:32 UTC · 2d agoThreat actorExploited14 sourcesCVE-2026-201271

Related CVEs

by mentions

CVE-2026-2012789%10.0
Authentication Bypass in Cisco Catalyst SD-WAN Controller, Manager, Validator
published Feb 25, 2026Cisco Catalyst SD-WAN Controller (formerly SD-WAN vSmart)KEV
CVE-2026-2018292%10.0
Authentication Bypass in Cisco Catalyst SD-WAN Control Components
published May 14, 2026Cisco Catalyst SD-WAN Controller (formerly SD-WAN vSmart)KEV
CVE-2026-76418<1%8.6
Unauthenticated DoS in Cisco ASA and FTD SSL VPN with secondary auth
published 2d agoCisco Secure Firewall Adaptive Security Appliance (ASA) SoftwareKEV

Appears with

Cisco Talosorganization · 7
KeyDriftmalware · 7
Volt Typhoonthreat actor · 7
UAT-11473threat actor · 7
Ciscovendor · 7
LittleFilchmalware · 7
Catalyst SD-WAN Controllerproduct · 3
Catalyst SD-WAN Managerproduct · 3
Catalyst SD-WAN Validatorproduct · 2
UAT-8616threat actor · 2
Lumenorganization · 2
Black Lotus Labsorganization · 2
aaamgrdmalware · 1
Silent Trainmalware · 1
Cisco Catalyst SD-WAN Managerproduct · 1
conf_sshdmalware · 1

Entities are extracted by the model from each article. First seen Oct 28, 2026, last mentioned 1d ago. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.