Hackers used a critical Cisco Catalyst SD-WAN flaw to plant custom malware called KeyDrift, which copies encryption keys for later use.
The vulnerability or weakness
The vulnerability is CVE-2026-20127, a critical flaw with a CVSS score of 10.0, allowing unauthenticated remote attackers to gain administrative privileges.
| CVE | CVSS | Severity | In CISA KEV | KEV due date |
|---|---|---|---|---|
| CVE-2026-20127 | 10.0 | CRITICAL | Yes, added 2026-02-25 | 2026-02-27 |
CVE data: NVD (nvd.nist.gov) and the CISA Known Exploited Vulnerabilities catalog.
Earlier attacks and coverage
- China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility (2026-10-29)
- Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens (2026-10-27)
- iOS, macOS 27.2 Patch 286 Bugs; Fix for Exploited Flaw Backported to iOS 18 (2026-10-27)
- Keystone to Destroy 18,835 Hardware Wallets After Hackers Steal Device Verification Key (2026-10-27)
- Lazarus Abuses South Korean Security Software to Deploy Malware Using Post-Quantum Encryption (2026-10-27)
Business impact
Organizations face potential data breaches and loss of sensitive information, impacting operations and reputation.
Industries affected
Space and satellite services, defense and aerospace technology, and policy research are among the affected sectors.
Users affected
Customers in targeted industries may have their encryption keys stolen, compromising the security of their data and communications.
