Skip to content
OriginalSign in

The Hacker Newsinfo@thehackernews.com (The Hacker News)

Hackers Exploit Cisco SD-WAN Flaw to Steal Encryption Keys

Part of the CVE-2026-20127 story · since 25 Feb

Developinglatest 12 minutes ago24 articles8 outlets
25 Feb · CISA first29 Jun10 Aug21 SepNowThis article23rd of 24
  • Wed 25 Feb, 17:32 UTC. CISA, first report. CISA adds CVE-2026-20127 after exploit of Cisco SD WAN auth bypass. Cites a CVE in CISA KEV.
  • Wed 25 Feb, 17:34 UTC. CISA. CISA adds CVE-2026-20127: Cisco SD WAN allows admin takeover. Cites a CVE in CISA KEV.
  • Thu 26 Feb, 00:45 UTC. Rapid7, its first report on the story. CISA orders emergency patch for Cisco SD WAN after CVE-2026-20127. Cites a CVE in CISA KEV.
  • Thu 26 Feb, 06:49 UTC. The Hacker News, its first report on the story. Critical CVE-2026-20127 in Cisco SD WAN gives remote admin access. Cites a CVE in CISA KEV.
  • Thu 26 Feb, 09:52 UTC. SecurityWeek, its first report on the story. Cisco patches exploited Catalyst SD WAN zero day CVE-2026-20127. Cites a CVE in CISA KEV.
  • Thu 26 Feb, 09:53 UTC. Infosecurity, its first report on the story. Five Eyes warn Cisco SD WAN zero day grants admin CVE-2026-20127. Cites a CVE in CISA KEV.
  • Thu 26 Feb, 12:56 UTC. Security Affairs, its first report on the story. CVE-2026-20127: Critical Cisco SD WAN flaw gives root access. Cites a CVE in CISA KEV.
  • Thu 26 Feb, 16:01 UTC. Security Affairs. CISA: CVE-2026-20127 lets attackers gain admin on Cisco SD WAN. Cites a CVE in CISA KEV.
  • Thu 26 Feb, 22:10 UTC. Dark Reading, its first report on the story. Cisco Catalyst SD WAN zero day CVE-2026-20127 exploited for years. Cites a CVE in CISA KEV.
  • Mon 2 Mar, 14:13 UTC. The Hacker News. Cisco SD WAN CVE-2026-20127 flaw bypasses auth for admin. Cites a CVE in CISA KEV.
  • Thu 5 Mar, 12:29 UTC. SecurityWeek. Catalyst SD WAN flaws CVE-2026-20128 exploited, Cisco warns. Cites a CVE in CISA KEV.
  • Thu 5 Mar, 16:41 UTC. The Hacker News. Cisco warns CVE-2026-20122 and CVE-2026-20128 exploited in SD-WAN. Cites a CVE in CISA KEV.
  • Sun 8 Mar, 12:49 UTC. SecurityWeek. Cisco Catalyst SDWAN flaw CVE-2026-20127 fuels internet attacks. Cites a CVE in CISA KEV.
  • Thu 12 Mar, 13:09 UTC. Infosecurity. CISA Issues Emergency Directive Over Exploited Cisco SD-WAN Flaws. Cites a CVE in CISA KEV.
  • Fri 13 Mar, 20:15 UTC. Dark Reading. Fake PoCs, Misunderstood Risks Cause Cisco SD-WAN Chaos. Cites a CVE in CISA KEV.
  • Thu 14 May, 19:41 UTC. Security Affairs. U.S. CISA adds a flaw in Cisco Catalyst SD-WAN to its Known Exploited Vulnerabilities catalog. Cites a CVE in CISA KEV.
  • Thu 14 May, 20:51 UTC. Dark Reading. Cisco SD WAN flaw lets attackers seize control, patch urged. Cites a CVE in CISA KEV.
  • Fri 15 May, 06:11 UTC. The Hacker News. CISA warns of Cisco Catalyst SDWAN flaw amid active exploitation. Cites a CVE in CISA KEV.
  • Fri 15 May, 06:41 UTC. SecurityWeek. Cisco patches SDWAN zero day CVE-2026-20182 exploited by UAT8616. Cites a CVE in CISA KEV.
  • Wed 30 Sep, 18:38 UTC. Rapid7. Cisco SD-WAN Flaw Exploited to Grant Attackers Admin Access. Cites a CVE in CISA KEV.
  • Wed 28 Oct, 19:30 UTC. The Hacker News. Volt Typhoon Used Silent Train in Four Zero Day Campaigns. Cites a CVE in CISA KEV.
  • Thu 29 Oct, 03:30 UTC. SecurityOnline, its first report on the story. UAT-11473 implants KeyDrift malware on Cisco SD-WAN systems. Cites a CVE in CISA KEV.
  • Thu 29 Oct, 09:30 UTC. The Hacker News. Hackers Exploit Cisco SD-WAN Flaw to Steal Encryption Keys. Cites a CVE in CISA KEV. This article, 23rd of 24.
  • Thu 29 Oct, 11:30 UTC. SecurityWeek. Cisco SD WAN flaw tied to UAT-11473 and Volt Typhoon. Cites a CVE in CISA KEV.

Cisco Talos has disclosed that hackers exploited a critical flaw in Cisco Catalyst SD-WAN products to deploy a bespoke malware payload known as KeyDrift. The vulnerability, CVE-2026-20127, earned a CVSS of 10.0 and allows an unauthenticated remote attacker to bypass authentication and gain administrative privileges on the SD-WAN Controller, Manager, and Validator (formerly vSmart, vManage, and vBond respectively).

Cisco added the Validator to its advisory in June, noting that on a compromised Controller, an attacker can log in as a high-privileged internal account that is not root. Talos characterises the activity as historical, with exploitation dating back to at least 2023, but does not specify exact dates or whether any keys were exfiltrated.

KeyDrift is designed to capture AES-256 key material used to encrypt traffic between SD-WAN sites. The malware operates by hooking into the vdaemon process that handles control traffic, extracting a 32-byte key material field, encrypting the data with RSA, and writing it to a file before exfiltrating it via UDP to a settings address (which the malware then deletes).

Talos notes the operator behind KeyDrift, tracked as UAT-11473, has targeted space, defence, aerospace, and policy research sectors, with infrastructure overlap to Silent Train. Cisco’s fixes address on-premises and hosted SD-WAN deployments, including Cisco Managed and FedRAMP environments; the first fixed releases appear across multiple release trains, with the earliest being 20.9.8.2 and continuing through 20.18.2.1.

Cisco warns there is no workaround, and upgrading may not remove already-present malware, advising thorough incident response and alignment with the remediation guide. Talos released Snort rules for KeyDrift and associated indicators, while Cisco recommends validating admin-tech files and re-scanning with Bug Search Tool guidance. (All CVE and release details are as stated by Cisco and Talos in the referenced disclosures.)

How the story developed

All 24 articles
Developinglatest 12 minutes ago24 articles8 outlets

24 articles from 8 outlets since 25 Feb. Picked up again on 28 Oct after 4 weeks quiet. This was the 23rd report, 246 days after the first.

Now25 Feb81312 May28 Sep6111621First reportCISA · 25 Feb, 17:32This article23rd of 24 · day 246
  • Wed 25 Feb, 17:32 UTC. CISA, first report. CISA adds CVE-2026-20127 after exploit of Cisco SD WAN auth bypass. Cites a CVE in CISA KEV.
  • Wed 25 Feb, 17:34 UTC. CISA. CISA adds CVE-2026-20127: Cisco SD WAN allows admin takeover. Cites a CVE in CISA KEV.
  • Thu 26 Feb, 00:45 UTC. Rapid7, its first report on the story. CISA orders emergency patch for Cisco SD WAN after CVE-2026-20127. Cites a CVE in CISA KEV.
  • Thu 26 Feb, 06:49 UTC. The Hacker News, its first report on the story. Critical CVE-2026-20127 in Cisco SD WAN gives remote admin access. Cites a CVE in CISA KEV.
  • Thu 26 Feb, 09:52 UTC. SecurityWeek, its first report on the story. Cisco patches exploited Catalyst SD WAN zero day CVE-2026-20127. Cites a CVE in CISA KEV.
  • Thu 26 Feb, 09:53 UTC. Infosecurity, its first report on the story. Five Eyes warn Cisco SD WAN zero day grants admin CVE-2026-20127. Cites a CVE in CISA KEV.
  • Thu 26 Feb, 12:56 UTC. Security Affairs, its first report on the story. CVE-2026-20127: Critical Cisco SD WAN flaw gives root access. Cites a CVE in CISA KEV.
  • Thu 26 Feb, 16:01 UTC. Security Affairs. CISA: CVE-2026-20127 lets attackers gain admin on Cisco SD WAN. Cites a CVE in CISA KEV.
  • Thu 26 Feb, 22:10 UTC. Dark Reading, its first report on the story. Cisco Catalyst SD WAN zero day CVE-2026-20127 exploited for years. Cites a CVE in CISA KEV.
  • Mon 2 Mar, 14:13 UTC. The Hacker News. Cisco SD WAN CVE-2026-20127 flaw bypasses auth for admin. Cites a CVE in CISA KEV.
  • Thu 5 Mar, 12:29 UTC. SecurityWeek. Catalyst SD WAN flaws CVE-2026-20128 exploited, Cisco warns. Cites a CVE in CISA KEV.
  • Thu 5 Mar, 16:41 UTC. The Hacker News. Cisco warns CVE-2026-20122 and CVE-2026-20128 exploited in SD-WAN. Cites a CVE in CISA KEV.
  • Sun 8 Mar, 12:49 UTC. SecurityWeek. Cisco Catalyst SDWAN flaw CVE-2026-20127 fuels internet attacks. Cites a CVE in CISA KEV.
  • Thu 12 Mar, 13:09 UTC. Infosecurity. CISA Issues Emergency Directive Over Exploited Cisco SD-WAN Flaws. Cites a CVE in CISA KEV.
  • Fri 13 Mar, 20:15 UTC. Dark Reading. Fake PoCs, Misunderstood Risks Cause Cisco SD-WAN Chaos. Cites a CVE in CISA KEV.
  • Thu 14 May, 19:41 UTC. Security Affairs. U.S. CISA adds a flaw in Cisco Catalyst SD-WAN to its Known Exploited Vulnerabilities catalog. Cites a CVE in CISA KEV.
  • Thu 14 May, 20:51 UTC. Dark Reading. Cisco SD WAN flaw lets attackers seize control, patch urged. Cites a CVE in CISA KEV.
  • Fri 15 May, 06:11 UTC. The Hacker News. CISA warns of Cisco Catalyst SDWAN flaw amid active exploitation. Cites a CVE in CISA KEV.
  • Fri 15 May, 06:41 UTC. SecurityWeek. Cisco patches SDWAN zero day CVE-2026-20182 exploited by UAT8616. Cites a CVE in CISA KEV.
  • Wed 30 Sep, 18:38 UTC. Rapid7. Cisco SD-WAN Flaw Exploited to Grant Attackers Admin Access. Cites a CVE in CISA KEV.
  • Wed 28 Oct, 19:30 UTC. The Hacker News. Volt Typhoon Used Silent Train in Four Zero Day Campaigns. Cites a CVE in CISA KEV.
  • Thu 29 Oct, 03:30 UTC. SecurityOnline, its first report on the story. UAT-11473 implants KeyDrift malware on Cisco SD-WAN systems. Cites a CVE in CISA KEV.
  • Thu 29 Oct, 09:30 UTC. The Hacker News. Hackers Exploit Cisco SD-WAN Flaw to Steal Encryption Keys. Cites a CVE in CISA KEV. This article, 23rd of 24.
  • Thu 29 Oct, 11:30 UTC. SecurityWeek. Cisco SD WAN flaw tied to UAT-11473 and Volt Typhoon. Cites a CVE in CISA KEV.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 24 articles as a list
  1. Wed 25 FebDay 02
    1. CISA adds CVE-2026-20127 after exploit of Cisco SD WAN auth bypass17:32 · CISA · official · First report · CISA alert · Known exploited CVE
    2. CISA adds CVE-2026-20127: Cisco SD WAN allows admin takeover17:34 · CISA · official · Known exploited CVE
  2. Thu 26 FebDay 17
    1. CISA orders emergency patch for Cisco SD WAN after CVE-2026-2012700:45 · Rapid7 · Known exploited CVE
    2. Critical CVE-2026-20127 in Cisco SD WAN gives remote admin access06:49 · The Hacker News · Known exploited CVE
    3. Cisco patches exploited Catalyst SD WAN zero day CVE-2026-2012709:52 · SecurityWeek · Known exploited CVE
    Show 4 more from 26 Feb
    1. Five Eyes warn Cisco SD WAN zero day grants admin CVE-2026-2012709:53 · Infosecurity · Known exploited CVE
    2. CVE-2026-20127: Critical Cisco SD WAN flaw gives root access12:56 · Security Affairs · Known exploited CVE
    3. CISA: CVE-2026-20127 lets attackers gain admin on Cisco SD WAN16:01 · Security Affairs · Known exploited CVE
    4. Cisco Catalyst SD WAN zero day CVE-2026-20127 exploited for years22:10 · Dark Reading · Known exploited CVE

  3. Quiet for 4 days

    Mon 2 MarDay 51
    1. Cisco SD WAN CVE-2026-20127 flaw bypasses auth for admin14:13 · The Hacker News · Picked up again · Known exploited CVE

  4. Quiet for 3 days

    Thu 5 MarDay 82
    1. Catalyst SD WAN flaws CVE-2026-20128 exploited, Cisco warns12:29 · SecurityWeek · Picked up again · Known exploited CVE
    2. Cisco warns CVE-2026-20122 and CVE-2026-20128 exploited in SD-WAN16:41 · The Hacker News · Known exploited CVE

  5. Quiet for 3 days

    Sun 8 MarDay 111
    1. Cisco Catalyst SDWAN flaw CVE-2026-20127 fuels internet attacks12:49 · SecurityWeek · Picked up again · Known exploited CVE

  6. Quiet for 4 days

    Thu 12 MarDay 151
    1. CISA Issues Emergency Directive Over Exploited Cisco SD-WAN Flaws13:09 · Infosecurity · Picked up again · Known exploited CVE
  7. Fri 13 MarDay 161
    1. Fake PoCs, Misunderstood Risks Cause Cisco SD-WAN Chaos20:15 · Dark Reading · Known exploited CVE

  8. Quiet for 9 weeks

    Thu 14 MayDay 782
    1. U.S. CISA adds a flaw in Cisco Catalyst SD-WAN to its Known Exploited Vulnerabilities catalog19:41 · Security Affairs · Picked up again · Known exploited CVE
    2. Cisco SD WAN flaw lets attackers seize control, patch urged20:51 · Dark Reading · Known exploited CVE
  9. Fri 15 MayDay 792
    1. CISA warns of Cisco Catalyst SDWAN flaw amid active exploitation06:11 · The Hacker News · Known exploited CVE
    2. Cisco patches SDWAN zero day CVE-2026-20182 exploited by UAT861606:41 · SecurityWeek · Known exploited CVE

  10. Quiet for 20 weeks

    Wed 30 SepDay 2171
    1. Cisco SD-WAN Flaw Exploited to Grant Attackers Admin Access18:38 · Rapid7 · Picked up again · Known exploited CVE

  11. Quiet for 4 weeks

    Wed 28 OctDay 2451
    1. Volt Typhoon Used Silent Train in Four Zero Day Campaigns19:30 · The Hacker News · Picked up again · Known exploited CVE
  12. Thu 29 OctDay 2463
    1. UAT-11473 implants KeyDrift malware on Cisco SD-WAN systems03:30 · SecurityOnline · Known exploited CVE
    2. Hackers Exploit Cisco SD-WAN Flaw to Steal Encryption Keys09:30 · The Hacker News · Known exploited CVE · This article, 23rd of 24
    3. Cisco SD WAN flaw tied to UAT-11473 and Volt Typhoon11:30 · SecurityWeek · Known exploited CVE

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in