#sd-wan
-
Hackers Used a Cisco SD-WAN Flaw to Deploy KeyDrift, Malware Built to Steal Encryption Keys
Cisco Talos has described KeyDrift, malware that attackers planted on Catalyst SD-WAN control systems through the critical CVE-2026-20127 flaw. Its job is to copy the AES keys that encrypt traffic between sites.
-
Arista Patches Actively Exploited VeloCloud Orchestrator Zero-Day
Arista has shipped fixes for on-premises VeloCloud Orchestrator: a critical SQL injection flaw is already being exploited and lets authenticated users escalate to superuser privileges.
-
Cisco patches fifth SD-WAN Manager zero-day of the year amid active attacks
A critical authentication-bypass flaw, CVE-2026-76504, lets an unauthenticated attacker gain admin rights on Catalyst SD-WAN Manager. Cisco has confirmed active exploitation and shipped fixes.
-
Maxed-Out VeloCloud Orchestrator Flaw Already Under Active Attack
Arista warns that a new flaw in on-premises VeloCloud Orchestrator is being actively exploited. Only orchestrators that authenticate their Edge devices with certificates are at risk.
-
Arista Patches Critical VeloCloud Orchestrator Zero-Day Already Exploited in Attacks
The flaw, rated a maximum 10.0, allows unauthenticated command execution on the SD-WAN management server. CISA has added it to its Known Exploited Vulnerabilities catalog.