// AI threat desk · 31 Oct 2026
Home/CVE · Vulns & Patches
Vulns & PatchesCriticalCVECVSS 10.0

Cisco Catalyst SD-WAN flaw exploited to deploy KeyDrift malware

UAT-11473 exploited CVE-2026-20127 to deploy KeyDrift on Cisco Catalyst SD-WAN Controllers. BleepingComputer disclosed the activity on Oct 28, 2026.

· 2 min read
AI-generated image of analysts monitoring network security dashboards beside rack-mounted networking equipment.
AI-generated image, not a photo of the event.
Key takeaways
  • BleepingComputer reported that UAT-11473 exploited CVE-2026-20127 to deploy KeyDrift malware on Cisco Catalyst SD-WAN Controllers.
  • The flaw allows an unauthenticated remote attacker to bypass authentication and obtain administrative privileges.
  • Cisco assigned the vulnerability a CVSS base score of 10.0.

Cisco Catalyst SD-WAN systems were targeted through CVE-2026-20127, with UAT-11473 exploiting the authentication-bypass flaw to deploy KeyDrift malware, BleepingComputer reported on Oct 28, 2026.

Cisco said the flaw allows an unauthenticated remote attacker to bypass authentication and obtain administrative privileges. The vulnerability affects Catalyst SD-WAN Controllers, Managers and Validators regardless of device configuration.

An SD-WAN uses software-defined networking technology and encrypted overlay tunnels to connect an organization’s internal locations. Cisco assigned CVE-2026-20127 a CVSS base score of 10.0.

On this page

KeyDrift is designed to copy traffic-encryption keys

Cisco Talos said KeyDrift is designed to copy the keys that encrypt traffic between sites and store them for later use.

CISA called for fresh SD-WAN control-plane instances after root compromise

CISA published its report on Feb 25, 2026. It identified CVE-2022-20775 as a related path-traversal vulnerability that allows an authenticated local attacker to gain elevated privileges and execute arbitrary commands as root.

For affected agencies after a root compromise, CISA said to deploy fresh vManage, vSmart and vBond instances from patched OVA or qcow2 images and migrate edges to the new infrastructure.

Cisco first published its advisory on Feb 25, 2026, and updated it on Oct 28, 2026. Cisco said there are no workarounds that address the vulnerability.

CISA said a cyber threat actor was conducting ongoing exploitation of Cisco SD-WAN systems. After a root compromise, it directed agencies to rebuild the control management plane with fresh vManage, vSmart and vBond instances from patched images and migrate their edges.

What to do now

  1. Restrict traffic to ports 22 and 830 to known controller IPs and other known IPs.
  2. Audit /var/log/auth.log for Accepted publickey entries for vmanage-admin from unknown or unauthorized IP addresses.

FAQ

What happened with CVE-2026-20127?

BleepingComputer reported that UAT-11473 exploited the authentication-bypass flaw in Cisco Catalyst SD-WAN Controllers to deploy KeyDrift malware.

Which Cisco SD-WAN products are affected?

Cisco said the vulnerability affects Catalyst SD-WAN Controllers, Managers and Validators regardless of device configuration.

Can CVE-2026-20127 let an attacker gain administrator access?

Cisco said an unauthenticated remote attacker could bypass authentication and obtain administrative privileges on an affected system.

How severe is CVE-2026-20127?

Cisco assigned it a CVSS base score of 10.0.

What does KeyDrift do?

Cisco Talos said KeyDrift is designed to copy keys that encrypt traffic between sites and store them for later use.

Is there a workaround for CVE-2026-20127?

Cisco said there are no workarounds that address the vulnerability. It recommends restricting traffic to ports 22 and 830 to known IP addresses and auditing auth.log for Accepted publickey entries for vmanage-admin from unknown or unauthorized IP addresses.

Sources

  1. ED 26-03: Mitigate Vulnerabilities in Cisco SD-WAN Systems | CISA, CISAPrimary
  2. Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability, CiscoPrimary
  3. Hackers Exploited Cisco SD-WAN Flaw to Plant Malware Built to Steal Encryption Keys, The Hacker News
  4. Hackers exploit Cisco SD-WAN flaw to deploy custom KeyDrift malware, BleepingComputer
  5. Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ Network, SecurityWeek
  6. SD-WAN, Wikipedia
How we checked this story
ClaimSourceStatus
The Hacker News reported that hackers exploited a critical Cisco Catalyst SD-WAN flaw to plant custom malware inside systems controlling an organization’s SD-WAN network.The Hacker NewsAttributed
BleepingComputer reported that UAT-11473 exploited CVE-2026-20127, an authentication-bypass flaw in Cisco Catalyst SD-WAN Controllers, to deploy KeyDrift malware.BleepingComputerAttributed
The Hacker News reported that CVE-2026-20127 has a CVSS score of 10.0.The Hacker NewsAttributed
SecurityWeek reported that CVE-2026-20127 has a CVSS score of 10.SecurityWeekAttributed
Cisco assigned CVE-2026-20127 a CVSS base score of 10.0.CiscoConfirmed
CISA said a cyber threat actor was conducting ongoing exploitation of Cisco SD-WAN systems.CISAAttributed
Cisco said the vulnerability allows an unauthenticated remote attacker to bypass authentication and obtain administrative privileges.CiscoConfirmed
Cisco first published its advisory on 25 February 2026 and updated it on 28 October 2026.CiscoConfirmed
Cisco said no workaround addresses the vulnerability.CiscoConfirmed
CISA directed agencies to deploy fresh vManage, vSmart and vBond instances from patched images and migrate their edges after a root compromise.CISAConfirmed
CISA identified CVE-2022-20775 as a related path-traversal vulnerability allowing an authenticated local attacker to gain elevated privileges and execute root commands.CISAConfirmed
An SD-WAN is a wide-area network that uses software-defined networking technology and encrypted overlay tunnels for internal organization locations.WikipediaConfirmed
CISA published its report on Feb 25, 2026.CISAConfirmed
sec.cloudapps.cisco.com published its report on Oct 28, 2026.sec.cloudapps.cisco.comConfirmed

Could not verify

  • Whether attackers sent or used any collected encryption keys is not established
  • How many organizations or devices were affected is not established
  • Whether UAT-11473 and Volt Typhoon are the same group is not established
  • Whether upgrading removes KeyDrift from already compromised devices is not established
cve
See all in Vulns & Patches →
Explore with AI
ChatGPT
Claude
Perplexity
Grok