CriticalAPTCVE-2026-20127
Hackers Exploit Critical Cisco SD-WAN 0-Day Flaw to Deploy KeyDrift Malware and Steal Encryption Keys
Cyber Security News·Source published ·1 min read
What happened?
A state-linked hacking group used a maximum-severity Cisco SD-WAN zero-day flaw to break into network controllers and install a custom malware framework called KeyDrift. The flaw is CVE-2026-20127. It carries a CVSS score of 10.0 and lets a remote attacker skip authentication and gain administrative rights without a password. KeyDrift is built to sit quietly inside the control system of a Cisco SD-WAN network. It copies the keys that protect traffic between company sites, and it also works as a backdoor.
Key details
- State-linked group used Cisco SD-WAN zero-day to gain admin rights and deploy KeyDrift malware.
- CVE-2026-20127 allows unauthenticated remote attacker to bypass authentication and gain admin rights.
- Cisco fixed CVE-2026-20127 in February 2026 with first fixed releases 20.9.8.2, 20.12.6.1, 20.15.4.2 and 20.18.2.1.
- UAT-11473 APT overlaps with Volt Typhoon's Silent Train network for covert access.
Affected
- Cisco Catalyst SD-WAN Controller, Manager and Validator running vulnerable software.
- Versions older than 20.9 must move to a supported release.
What to look for
- Modified runit launcher path /etc/sv/sshd/ and malicious service path /etc/sv/aaamgr/.
- Files /var/tmp/vdaemon.bin and /var/tmp/vdaemon.conf containing stolen key data.
- Snort detection rules SIDs 67387-67416 and 7:44-7:73 for KeyDrift malware.
Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.