A severe vulnerability in Cisco’s SD-WAN technology has been exploited by a state-sponsored hacking group, leading to the installation of malicious software known as KeyDrift. This zero-day flaw, identified as CVE-2026-20127, allows attackers to bypass authentication measures and gain administrative access to network controllers without the need for a password.
Understanding the Cisco SD-WAN Vulnerability
The critical security flaw, carrying a perfect CVSS score of 10.0, is found within the peering authentication of the Catalyst SD-WAN Controller, Manager, and Validator. By sending specially crafted requests, attackers are able to log in with high-privilege credentials, enabling them to alter network configurations through NETCONF.
Despite efforts, Cisco has confirmed that no workaround exists for this flaw, making immediate patching essential. The vulnerability has been publicly exploited, increasing the risk for systems that have not yet been updated.
KeyDrift Malware and Its Implications
Once inside the system, attackers deploy KeyDrift, a malware framework designed to stealthily operate within the Cisco SD-WAN control system. KeyDrift facilitates the theft of encryption keys that secure inter-site traffic and acts as a backdoor for further access.
The malware targets industries such as space and satellite services, defense, aerospace companies, and policy research organizations. The research team from Cisco Talos, which identified the malware, has linked the attacks to an advanced persistent threat group known as UAT-11473, highlighting the sophistication and historical nature of these intrusions.
Defense Measures and Recommendations
Cisco released patches for the vulnerability in February 2026, with fixed versions including 20.9.8.2, 20.12.6.1, 20.15.4.2, and 20.18.2.1. Organizations are urged to ensure their systems are updated to these versions or later to protect against the exploitation.
However, patching alone may not be sufficient for previously compromised networks. It is recommended to inspect log files for unusual access patterns and unauthorized login attempts. Additionally, administrators should restrict access to ports 22 and 830 to known addresses and monitor for any signs of malware presence.
For comprehensive security, the Cisco security advisory provides detailed guidance on addressing this flaw and mitigating similar threats in the future. Organizations should remain vigilant, integrating threat intelligence and maintaining robust monitoring systems to detect and mitigate potential threats swiftly.
