Hackers exploit Cisco SD-WAN flaw to deploy custom KeyDrift malware

A maximum-severity authentication-bypass vulnerability in Cisco Catalyst SD-WAN Controllers (CVE-2026-20127) was exploited by an advanced persistent threat group to deploy the custom KeyDrift malware framework, targeting critical defense, aerospace, and policy organizations. Despite a patch being available since February 2026, the vulnerability remained unaddressed in victim environments long enough for attackers to establish persistent access and intercept encrypted control-plane traffic. This incident underscores the extreme risk of delayed patching on internet-facing network infrastructure, particularly when the vulnerability carries a maximum severity rating. The ability of KeyDrift to extract cryptographic keying material from SD-WAN controllers represents a catastrophic confidentiality failure, potentially compromising all traffic protected by those keys. Organizations supporting national security or critical infrastructure sectors face an elevated threat from state-sponsored actors who actively monitor public vulnerability disclosures and weaponize them rapidly.