Hackers exploit Cisco SD-WAN flaw to deploy custom KeyDrift malware
MALWARECVE-2025-8875redteam/daily · 3 sources
- Exploited
- Yes
- Sources
- 3
What happened
No summary yet. The timeline below shows what each source reported, in order.
From 3 sources · Wrong?
What to do
- CVE-2025-8875 is being exploited: treat it as urgent.
- CISA’s required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Check whether you use N-able N-Central: add it to your watchlist to hear when it is affected. Open your watchlist
- Check whether you use Arista VeloCloud Orchestrator: add it to your watchlist to hear when it is affected. Open your watchlist
Based on advisory data
Vulnerabilities
Full story timeline · 8 updates
- Wed 13 AugustCVE-2025-8875 added to CISA’s exploited listCISA KEV
- CVE-2025-8876 added to CISA’s exploited listCISA KEV
- Wed 25 FebruaryCVE-2026-20127 added to CISA’s exploited listCISA KEV
- Thu 14 MayCVE-2026-20182 added to CISA’s exploited listCISA KEV
- Mon 27 JulyCVE-2026-16812 added to CISA’s exploited listCISA KEV
- Wed 28 OctoberInside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WANCisco Talos
- Thu 29 OctoberHackers Exploit Critical Cisco SD-WAN 0-Day Flaw to Deploy KeyDrift Malware and Steal Encryption KeysCyber Security News
- Hackers exploit Cisco SD-WAN flaw to deploy custom KeyDrift malwareBleepingComputer
Who reported · 3 outlets
Cisco TalosCyber Security NewsBleepingComputer