Cisco Talos details attacks exploiting CVE-2026-20127, a CVSS 10.0 SD-WAN vulnerability allowing unauthenticated remote access.
The deployed KeyDrift malware utilizes components like LittleFilch to extract AES-256 keys and PolyFlame for memory-resident backdoors, targeting defense and aerospace networks.
The issue affects Cisco's network control systems, known as Catalyst SD-WAN, and affects both on-premises equipment and services provided remotely. The vulnerability could allow remote attackers to gain full administrative access to management systems without requiring a password.
How the attack worked
According to security researchers, the attackers used this vulnerability to place a malicious program called KeyDrift. This program operates secretly in control systems, reads communication messages after they are decrypted and copies the keys used to protect data.
The group behind the attacks targeted services related to space, aeronautics, defense, and policy research.
What should organizations do?
Cisco has released software updates that fix the issue and noted that limited attacks have been detected. At the same time, experts point to security warnings that any previous breaches may remain even after the update is installed, making it necessary to check for any suspicious activity.
↳
READ ALSO
HACKS.GR / RELATED
Cyber Attacks & Data Breaches
Hacker group exploits VMware software to hide its tracks
↗
G
HACKS.GR / GOOGLE SEARCH
Hacks.gr on Google
Set Hacks.gr as a preferred source.
Preferred source
↗
end of article
Top comments (0)