Hackers Exploited Cisco SD-WAN Flaw to Plant Malware Built to Steal Encryption Keys
Summary: Cisco Talos reported on October 28 that attackers exploited CVE-2026-20127, a CVSS 10.0 authentication bypass in Cisco Catalyst SD-WAN Controller, Manager and Validator, to plant custom malware called KeyDrift that copies the AES-256 keys routers use to encrypt site-to-site traffic. KeyDrift's LittleFilch component hooks the vdaemon process to read decrypted control messages, while PolyFlame runs in memory inside vdaemon as a backdoor and relay, and a fake aaamgr service on compromised Validators runs a packed loader called aaamgrd.
What's compelling: The malware was built specifically to lift the AES-256 keys that encrypt traffic between sites, and Talos could not recover the settings file that would show where collected keys were sent - so the question of whether those keys should be replaced is left open, and Cisco's remediation guidance does not answer it.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-20127
- Related
- CVE-2026-20127: Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability Known Exploited Vulnerabilities · Feb 25, 2026