SecurityWeek links Cisco SD-WAN zero-day exploitation to Volt Typhoon
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- Cisco
- Product
- SD-WAN controller
- First seen
Summary
A linked SecurityWeek article reports zero-day exploitation of Cisco SD-WAN, which the URL associates with Volt Typhoon. The post also refers to KeyDrift malware, and the details come from that article rather than from Cisco's advisory.
If you use Cisco
Patch Cisco SD-WAN controller components immediately
Audit SD-WAN configurations for unauthorized changes
Hunt for KeyDrift malware on SD-WAN infrastructure
Apply the Cisco security updates for ASA and Threat Defense immediately.
Check SSL VPN devices for crashes or unexplained restarts.
Consult Cisco's security advisory for affected versions and CVE IDs.
What the sources say 28
· Mastodon: “In October 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability.” Source
· Mastodon: “Patch CVE-2026-76418 now. This high-severity Cisco Secure Firewall vulnerability is exploited in the wild to trigger SSL VPN DoS reloads on ASA and FTD.” Source
· Mastodon: “A critical Cisco SD-WAN flaw, rated a maximum severity score of 10.0, has been exploited by attackers to plant custom malware, known as KeyDrift, inside targeted systems, allowing them to bypass authentication and gain administrative privileges.” Source
· Mastodon: “Cisco is warning of a high-severity zero-day flaw, CVE-2026-76418, that can be exploited to crash SSL VPN firewalls on its Adaptive Security Appliance (ASA) and Threat Defense (FTD) software.” Source
· Mastodon: “Per policy, operators should patch Cisco SD-WAN controller components immediately, audit SD-WAN configurations for unauthorized changes, and hunt for KeyDrift malware.” Source
· Mastodon: “Cisco patches actively exploited zero-day (CVE-2026-76418) in ASA & FTD firewalls.” Source
· Bluesky: “New Cisco firewall zero-day exploited to crash SSL VPN devices” Source
· Bluesky: “Hackers Exploit Critical Cisco SD-WAN 0-Day Flaw to Deploy KeyDrift Malware and Steal Encryption Keys” Source
· Bluesky: “New Cisco firewall zero-day exploited to crash SSL VPN devices” Source
· Mastodon: “🚨 BREAKING: CISCO FIREWALL ZERO-DAY ACTIVELY EXPLOITED! CVE-2026-76418 (CVSS 8.6) lets unauthenticated attackers remotely CRASH vulnerable Cisco ASA & FTD firewalls.” Source
· Bluesky: “Cisco ASA/FTD zero-day CVE-2026-76418 is exploited to crash firewalls via SSL VPN if a tunnel group uses secondary auth.” Source
· Bluesky: “Attackers Exploit Second Cisco Firewall VPN Zero-Day Since August” Source
· Bluesky: “New Cisco firewall zero-day exploited to crash SSL VPN devices” Source
· Bluesky: “New Cisco firewall zero-day being actively exploited” Source
· Bluesky: “Volt Typhoon-linked attackers exploited a CVSS 10 Cisco Catalyst SD-WAN zero-day since 2023 to steal encryption keys.” Source
· Bluesky: “New Cisco firewall zero-day being actively exploited” Source
· Bluesky: “BREAKING: Cisco ASA/FTD zero-day CVE-2026-76418 actively exploited in the wild — unauthenticated remote attackers crash SSL VPN devices via crafted requests.” Source
· Bluesky: “BREAKING: Cisco ASA/FTD zero-day CVE-2026-76418 actively exploited in the wild — unauthenticated remote attackers crash SSL VPN devices via crafted requests.” Source
· Mastodon: “New # Cisco # firewall zero-day exploited to crash # SSL # VPN devices” Source
· Bluesky: “New #Cisco #firewall zero-day exploited to crash #SSL #VPN devices” Source
· Bluesky: “New Cisco firewall zero-day exploited to crash SSL VPN devices” Source
· r/cybersecurity: “Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon's 'Silent Train' Network” Source
· Mastodon: “Volt Typhoon is actively exploiting Cisco SD-WAN zero-day CVE-2026-20127 (CVSS 10) to deploy KeyDrift malware and steal encryption keys from SD-WAN controllers.” Source
· Mastodon: “Hackers exploit # Cisco # SDWAN flaw to deploy custom # KeyDrift # malware” Source
· Mastodon: “Cisco patches actively exploited zero-day (CVE-2026-76418) in ASA & FTD firewalls.” Source
· Bluesky: “Cisco patches actively exploited zero-day (CVE-2026-76418) in ASA & FTD firewalls.” Source
· Mastodon: “A newly identified advanced persistent threat (APT) group tracked as UAT-11473 was observed exploiting CVE-2026-20127, an authentication-bypass flaw...” Source
· Mastodon: “A newly identified advanced persistent threat (APT) group tracked as UAT-11473 was observed exploiting CVE-2026-20127, an authentication-bypass flaw...” Source