Hackers exploited the critical Cisco Catalyst SD-WAN flaw CVE-2026-20127, which has a CVSS score of 10.0, to install custom malware named KeyDrift. The unauthenticated remote attack bypasses authentication, gains administrative privileges, and lets a component called LittleFilch hook into the Controller's vdaemon process to steal AES-256 key material from control messages. LittleFilch encrypts the data with RSA, writes it to a file and exfiltrates it over UDP before deleting the settings file. KeyDrift is delivered via modified runit scripts that launch a loader (conf_sshd) and inject the PolyFlame module into vdaemon, providing a TinyShell-like backdoor. The vulnerability affects Catalyst SD-WAN Controller, Manager and Validator, both on-premises and in Cisco’s hosted cloud, and Cisco’s first fixed releases start at 20.9.8.2 and 20.12.6.1. Cisco advises installing the fixes, applying its hardening guide, and monitoring for post-compromise activity. 1