Volt Typhoon-linked actor exploited Cisco SD-WAN zero-day to steal encryption keys
CVE-2026-20127 (CVSS 10) gives unauthenticated admin access to SD-WAN controllers; KeyDrift malware siphoned keying material and Volt Typhoon kept exploiting the flaw after disclosure.
13