“KeyDrift” Malware Stole Cisco SD-WAN Encryption Keys for Years Before Detection (CVE-2026-20127)

Scope: Cisco Catalyst SD-WAN Controller, Manager, and Validator (patched since February 2026)

Severity: Red

Cisco Talos published research on October 28, 2026 detailing KeyDrift, a custom malware framework that a state-linked threat cluster tracked as UAT-11473, with infrastructure overlapping the Volt Typhoon-linked Silent Train botnet, planted inside Cisco Catalyst SD-WAN control-plane processes. The entry point is CVE-2026-20127, a maximum severity authentication bypass that Cisco fixed in February 2026, but separate research from Lumen’s Black Lotus Labs and CERT-EU indicates the flaw was being exploited as a zero-day since 2023, years before Cisco’s own disclosure. KeyDrift is not a typical backdoor focused on maintaining access; it is purpose-built to harvest AES-256 encryption key material that protects traffic moving between an organisation’s sites, running quietly inside the vdaemon process to copy keys for what Talos assesses enables passive retrospective decryption of inter-site traffic for targeted edge routers. Confirmed targets include space and satellite services, defense and aerospace companies, and policy research groups, though the scale of the campaign beyond named victims remains unclear. The critical point for defenders is that patching the authentication bypass does nothing to undo keys already stolen during the exposure window, which for many organisations now spans years rather than months. Organisations running Cisco Catalyst SD-WAN must confirm every Controller, Manager, and Validator instance runs a patched build today, and should treat key rotation as a separate, necessary step rather than assuming the patch alone resolves the exposure, particularly for any deployment that has been in service since before February 2026.

The Uganda National CERT and Coordination Center (CERT.UG/CC) encourages users and administrators to review the recommendations and apply the necessary updates.