apt

KeyDrift steals Cisco SD-WAN keys via a 2023 zero-day

Cisco Talos found KeyDrift malware inside Catalyst SD-WAN controllers stealing AES-256 keys via CVE-2026-20127. What it takes, who runs it, and how to respond.