Cisco Catalyst SD-WAN Flaw Exploited to Deploy KeyDrift Malware Targeting Encryption Keys

According to Cisco Talos, threat actors exploited a critical flaw in Cisco Catalyst SD-WAN to plant custom malware within the systems that control an organization's SD-WAN network. The malware, identified as KeyDrift, is engineered to copy the encryption keys that protect traffic between sites and store them for later use. Cisco Talos stated on October 28, 2026, that the attacks are historical in nature but did not specify when they occurred or provide detailed technical indicators of the exploitation path.

The SD-WAN platform is designed to manage and orchestrate traffic across multiple sites, making the control systems a high-value target. By extracting encryption keys, attackers could potentially decrypt, monitor, or manipulate site-to-site traffic flowing through the compromised network. Cisco released a patch for the underlying vulnerability in February 2026, and the company advises organizations to ensure their SD-WAN systems are updated to the latest patched version to mitigate the risk.

Talos has not attributed the attacks to a specific threat actor or named a CVE identifier in the initial report. The exact nature of the vulnerability, the specific versions affected, and the full capabilities of the KeyDrift malware beyond key copying remain areas requiring further investigation.