Cisco SD-WAN flaw exploited to deploy KeyDrift malware

An advanced threat actor group is actively exploiting an authentication bypass vulnerability in Cisco Catalyst SD-WAN Controllers, tracked as CVE-2026-20127. The attack leverages this flaw to compromise core network infrastructure and deploy a custom malware framework named KeyDrift. Network administrators are strongly urged to apply official Cisco patches immediately to secure affected controllers against ongoing exploitation.