Cisco says hackers exploited Catalyst SD-WAN flaw to deploy KeyDrift malware
- Status
- Confirmed
- Kind
- Vulnerability
- Vendor
- Cisco
- Product
- Secure Firewall ASA and Secure Firewall Threat Defense
- First seen
- Confirmed
Summary
Cisco Talos reported on October 28 that attackers exploited a critical Cisco Catalyst SD-WAN flaw, which Cisco fixed in February, to install custom malware called KeyDrift. The malware is designed to copy encryption keys used for traffic between sites, and Talos describes the attacks as historical without specifying when they occurred.
If you use Cisco
Confirm that Cisco's February fix for the Catalyst SD-WAN flaw is applied to all controllers and edge devices.
Check SD-WAN management systems for KeyDrift malware and follow Talos's published indicators.
Rotate encryption keys used for inter-site traffic, since the malware targets them.
Apply Cisco's security fixes for Secure Firewall ASA and FTD immediately
Review remote access SSL VPN logs for unusual or unauthenticated activity
Restrict internet exposure of the SSL VPN service until patched
What the sources say 42
· Mastodon: “In October 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability.” Source
· Mastodon: “This high-severity Cisco Secure Firewall vulnerability is exploited in the wild to trigger SSL VPN DoS reloads on ASA and FTD.” Source
· The Hacker News: “Hackers exploited a critical Cisco Catalyst SD-WAN flaw, fixed in February, to plant custom malware inside the systems that control an organization's SD-WAN network.” Source
· Mastodon: “A critical Cisco SD-WAN flaw, rated a maximum severity score of 10.0, has been exploited by attackers to plant custom malware, known as KeyDrift, inside targeted systems, allowing them to bypass authentication and gain administrative privileges.” Source
· SecurityWeek: “Cisco on Wednesday released fixes for an exploited vulnerability affecting its Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) software.” Source
· Bluesky: “Cisco patched an exploited ASA and FTD bug, CVE-2026-76418, CVSS 8.6, in Remote Access SSL VPN.” Source
· SecurityWeek: “Cisco Talos linked SD-WAN key-stealing malware to infrastructure overlapping Volt Typhoon’s Silent Train network, which Lumen detailed.” Source
· The Hacker News: “Cisco has released patches to address a high-severity security flaw in Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software that it said has been exploited in the wild.” Source
· BleepingComputer: “Cisco released security updates to patch a denial-of-service zero-day in Adaptive Security Appliance (ASA) and Threat Defense (FTD) software that attackers are exploiting to remotely crash vulnerable firewall devices.” Source
· BleepingComputer on Bluesky: “Cisco released security updates to patch a denial-of-service zero-day in Adaptive Security Appliance (ASA) and Threat Defense (FTD) software that attackers are exploiting to remotely crash vulnerable firewall devices.” Source
· Bluesky: “New Cisco firewall zero-day exploited to crash SSL VPN devices” Source
· Mastodon: “Cisco is warning of a high-severity zero-day flaw, CVE-2026-76418, that can be exploited to crash SSL VPN firewalls on its Adaptive Security Appliance (ASA) and Threat Defense (FTD) software.” Source
· Bluesky: “Cisco patches actively exploited ASA and FTD firewall zero-day CVE-2026-76418, which lets unauthenticated attackers crash vulnerable devices remotely.” Source
· Bluesky: “New Cisco firewall zero-day exploited to crash SSL VPN devices” Source
· Bluesky: “Cisco has released urgent security updates to address a high-severity zero-day vulnerability affecting its Adaptive…” Source
· Mastodon: “https://www. securityweek.com/cisco-sd-wan- zero-day-exploitation-tied-to-volt-typhoons-silent-train-network” Source
· Bluesky: “A second Cisco firewall VPN zero-day since August is being exploited — unauthenticated attackers can remotely force ASA and FTD firewalls to reload.” Source
· Mastodon: “Cisco patches actively exploited zero-day (CVE-2026-76418) in ASA & FTD firewalls.” Source
· Bluesky: “Cisco patches actively exploited zero-day (CVE-2026-76418) in ASA & FTD firewalls.” Source
· Bluesky: “Tracked as CVE-2026-76418, this high-severity vulnerability affects devices running ASA and FTD software with configurations containing the 'webvpn' keyword and SSL VPN enabled on at least one interface.” Source
· Bluesky: “An actively exploited Cisco zero-day flaw is crashing firewall VPN devices.” Source
· Bluesky: “Attackers reportedly exploited this zero-day in the wild to remotely crash SSL VPN devices without needing any login credentials.” Source
· Bluesky: “Cisco released security updates to patch a denial-of-service zero-day in Adaptive Security Appliance (ASA) and Thre...” Source
· Hacker News: “New Cisco firewall zero-day exploited to crash SSL VPN devices” Source
· Bluesky: “Hackers Exploit Critical Cisco SD-WAN 0-Day Flaw to Deploy KeyDrift Malware and Steal Encryption Keys” Source
· Bluesky: “New Cisco firewall zero-day exploited to crash SSL VPN devices” Source
· Mastodon: “🚨 Cisco ASA/FTD SSL VPN zero-day CVE-2026-76418 is being actively exploited.” Source
· Mastodon: “BREAKING: CISCO FIREWALL ZERO-DAY ACTIVELY EXPLOITED! CVE-2026-76418 (CVSS 8.6) lets unauthenticated attackers remotely CRASH vulnerable Cisco ASA & FTD firewalls.” Source
· Bluesky: “Cisco ASA/FTD zero-day CVE-2026-76418 is exploited to crash firewalls via SSL VPN if a tunnel group uses secondary auth.” Source
· Bluesky: “Attackers Exploit Second Cisco Firewall VPN Zero-Day Since August” Source
· Bluesky: “New Cisco firewall zero-day exploited to crash SSL VPN devices” Source
· BleepingComputer: “A newly identified advanced persistent threat (APT) group tracked as UAT-11473 was observed exploiting CVE-2026-20127, an authentication-bypass flaw in Cisco Catalyst SD-WAN Controllers, to deploy a custom malware framework called KeyDrift.” Source
· Bluesky: “New Cisco firewall zero-day being actively exploited” Source
· Bluesky: “Volt Typhoon-linked attackers exploited a CVSS 10 Cisco Catalyst SD-WAN zero-day since 2023 to steal encryption keys.” Source
· Bluesky: “New Cisco firewall zero-day being actively exploited” Source
· Bluesky: “New Cisco firewall zero-day exploited to crash SSL VPN devices” Source
· Bluesky: “BREAKING: Cisco ASA/FTD zero-day CVE-2026-76418 actively exploited in the wild — unauthenticated remote attackers crash SSL VPN devices via crafted requests.” Source
· Bluesky: “BREAKING: Cisco ASA/FTD zero-day CVE-2026-76418 actively exploited in the wild — unauthenticated remote attackers crash SSL VPN devices via crafted requests.” Source
· Mastodon: “Cisco conferma lo sfruttamento in the wild; attori e scala non noti.” Source
· Mastodon: “Hackers are actively exploiting a Cisco firewall DoS vulnerability in ASA and FTD devices, forcing sudden reboots without authentication.” Source
· Mastodon: “Cisco patched a high-severity zero-day vulnerability (CVE-2026-76418) in ASA and FTD software that allows unauthenticated attackers to remotely crash SSL VPN devices.” Source
· Bluesky: “Cisco released security updates to patch a denial-of-service zero-day in Adaptive Security Appliance (ASA) and Threat Defense (FTD) software that attackers are exploiting to remotely crash vulnerable firewall devices.” Source