Security AlertCritical
Cisco SD-WAN flaw let hackers plant malware to steal encryption keys
Oct 29, 2026 · Summarized by Fundy Tech from The Hacker News
The 30-second version
Cisco Talos says attackers used CVE-2026-20127 to break into Cisco Catalyst SD-WAN controllers and install KeyDrift malware. The malware can copy keys that encrypt traffic between sites.
Key points
- CVE-2026-20127 lets unauthenticated attackers gain admin privileges.
- Talos says the malware is called KeyDrift.
- The activity was linked to a group Talos tracks as UAT-11473.
Why it matters
If your business uses SD-WAN, a compromise could expose traffic keys and weaken the privacy of site-to-site connections. That matters for companies moving customer data or internal files between offices.
Who’s affected: Cisco Catalyst SD-WAN controllers and related systems
What to do
- Patch Cisco Catalyst SD-WAN software.
- Review controller and validator systems for unusual scripts or processes.
- Check for exposed SD-WAN management access.
- Monitor site-to-site encryption key handling.
Vulnerability IDs
Original reporting
Not sure if this affects you?
Fundy Tech helps businesses and households across Atlantic Canada stay patched, protected and up to speed. Tell us what you’re running and we’ll tell you straight whether you need to act.