Hackers exploit Cisco SD-WAN flaw to deploy custom KeyDrift malware
CVE-2026-20127, patched in February 2026, lets attackers add rogue peers and steal IPsec key material from controllers.
84
Malware
Silent Train
- Mentions · 7d3
- Mentions · 30d3
- All mentions3
- First seenOct 28, 2026
- Last mentioned1d ago
Timeline
3 articles · newest firstVolt Typhoon uses Silent Train relays for zero-day edge attacks
Black Lotus Labs says four confirmed zero-days hit VeloCloud, Cisco SD-WAN, N-central, and Versa Director.
86
Volt Typhoon rebuilt Silent Train relay chains since late 2023
Black Lotus Labs says chains were rebuilt in under two minutes and hundreds of victims were notified.
84
Related CVEs
by mentions- CVE-2026-2012789%10.0Authentication Bypass in Cisco Catalyst SD-WAN Controller, Manager, Validator
- CVE-2026-168122%10.0OS Command Injection in Arista VeloCloud Orchestrator On-Prem
- CVE-2025-88764%9.4OS Command Injection in N-able N-central Before 2025.3.1
- CVE-2025-88753%9.4Insecure Deserialization Code Execution in N-able N-central (KEV)
- CVE-2024-397174%7.2Unrestricted File Upload in Versa Networks Versa Director Exploited by Volt Typhoon
Appears with
- Ciscovendor · 3
- Volt Typhoonthreat actor · 3
- VeloCloud Orchestratorproduct · 2
- Lumenorganization · 2
- Versa Directorproduct · 2
- FBIorganization · 2
- Cisco Catalyst SD-WANproduct · 2
- Black Lotus Labsorganization · 2
- Netgearvendor · 2
- N-able N-centralproduct · 2
- ManageEnginevendor · 1
- Lumen Technologiesorganization · 1
- NCSCorganization · 1
- KV-Botnetmalware · 1
- N-ablevendor · 1
- UAT-8616threat actor · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.