Securityweek

CISA Includes Coruna Exploit Kit iOS Vulnerabilities in KEV List

First seen 6 Mar 2026, 15:13 UTC • Securityweek

•45.3

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

CISA has added 23 vulnerabilities exploited by the Coruna exploit kit targeting iOS versions 13 to 17.2.1 to its Known Exploited Vulnerabilities (KEV) list. The exploit kit is associated with nation-state actors, emphasizing the urgency for organizations to patch the identified flaws as mandated by Binding Operational Directive (BOD) 22-01.

How this analysis works

Timeline

2026-03-06

CISA adds iOS flaws from Coruna exploit kit to KEV list

Attack Flow

15 entities, 31 inferred relationships (STIX 2.1).

Threat Actor (2)

Unc6353
Unc6691

Technique (1)

Zero-day Exploit

Vulnerability (8)

CVE-2017-7921
CVE-2021-22681
CVE-2021-30952
CVE-2023-41974
CVE-2023-43000
Buffout
EternalBlue
Terrorbird

Malware (2)

Coruna
Parallax

Affected Platform (1)

Tool (1)

Coruna Exploit Kit

Relationships

Unc6353 uses Coruna
Unc6353 uses Parallax
Unc6691 uses Coruna
Unc6691 uses Parallax
Unc6353 uses Coruna Exploit Kit
Unc6691 uses Coruna Exploit Kit
Unc6353 uses Zero-day Exploit
Unc6691 uses Zero-day Exploit
Coruna exploits CVE-2017-7921
Coruna exploits CVE-2021-22681
Coruna exploits CVE-2021-30952
Coruna exploits CVE-2023-41974
Coruna exploits CVE-2023-43000
Parallax exploits CVE-2017-7921
Parallax exploits CVE-2021-22681
Parallax exploits CVE-2021-30952
Parallax exploits CVE-2023-41974
Parallax exploits CVE-2023-43000
Coruna Exploit Kit exploits CVE-2017-7921
Coruna Exploit Kit exploits CVE-2021-22681
Coruna Exploit Kit exploits CVE-2021-30952
Coruna Exploit Kit exploits CVE-2023-41974
Coruna Exploit Kit exploits CVE-2023-43000
CVE-2017-7921 targets IOS
CVE-2021-22681 targets IOS
CVE-2021-30952 targets IOS
CVE-2023-41974 targets IOS
CVE-2023-43000 targets IOS
Buffout targets IOS
EternalBlue targets IOS
Terrorbird targets IOS

Continue Reading

DarkSword iOS Exploit Chain Targets Mobile Devices Globally Coruna and DarkSword iOS Exploit Kits Targeting Users Globally Coruna iOS Exploit Kit Targets Multiple Threat Actors

CISA Includes Coruna Exploit Kit iOS Vulnerabilities in KEV List

Article Content

Timeline

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Continue Reading