Is your Cisco SD-WAN compromised? What KeyDrift looks for

A flaw rated 10 out of 10 and fixed in February was used to plant malware that copies the keys encrypting traffic between your sites. Cisco Talos described the malware, called KeyDrift, on October 28. It calls the attacks historical but doesn’t say when they happened or whether any keys were sent out.

However, the vulnerability known as CVE-2026-20127 enables an attacker without authentication credentials to break through the authentication process and obtain administrative privileges on Cisco Catalyst SD-WAN control systems.

Key Drift and SD-WAN encryption keys

Once the controller is successfully breached, the KeyDrift component LittleFilch attaches itself to the vdaemon process and starts reading the control messages once they get decrypted. It extracts from those messages IP addresses of edge routers and a 32-byte chunk…