Apple urges iPhone users to update as Coruna and DarkSword exploit kits emerge

CVE-2020-27932 is a type confusion flaw (CWE-843) in the kernel of Apple's iPhone/iPad OS, macOS, and watchOS, addressed with improved state handling in Apple's November 2020 security releases. It is triggered when a malicious (or compromised) application already running on the device sends input that confuses object types in kernel state handling — the attack is local and requires the user to run the app. A successful attacker gains arbitrary code execution with kernel privileges, the highest privilege level on the device, enabling full device control, persistence, and access to sensitive data. Anyone running unpatched iPhones, iPads, Macs, or Apple Watches is affected, and the CISA data also lists iCloud and iTunes among the affected Apple products. The flaw is in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03) with an EPSS of ~10.3% (95th percentile), and related reporting ties it to exploit kits (Coruna, DarkSword) used by a threat actor deploying roughly 11 zero-days against iOS 13 devices, so exploitation in the wild is established.

Do: Patch immediately: update to iOS/iPadOS 14.2 (or iOS 12.4.9 for older devices), macOS Big Sur 11.0.1, macOS Catalina 10.15.7 Supplemental Update, or Security Update 2020-006 (High Sierra/Mojave), and watchOS 7.1/6.2.9/5.3.9; also update iCloud and iTunes for Windows per Apple's advisory. Because exploitation in the wild is confirmed and exploit kits targeting iOS 13 are reported, audit Apple endpoints for signs of compromise and ensure users install apps only from trusted sources until patched.

CVE-2021-30952 is an integer overflow (CWE-190) in the WebKit web engine used across Apple's platforms — the same engine shipped as WebKitGTK and WPE WebKit on Linux — which Apple addressed with improved input validation. An attacker triggers it by persuading a user to process maliciously crafted web content, such as loading an attacker-controlled web page, and successful exploitation leads to arbitrary code execution on the victim's device (CVSS 3.1: 7.8 high, with a local attack vector requiring user interaction). All users of unpatched affected platforms are exposed: iOS/iPadOS before 15.2, macOS Monterey before 12.1, Safari before 15.2, tvOS before 15.2, and watchOS before 8.3, plus Fedora/Debian systems running unpatched WebKitGTK/WPE WebKit. Exploitation is confirmed in the wild: CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2026-03-05 (ransomware use: unknown), and Google threat intelligence documented it as part of the 'Coruna' iOS exploit kit — 23 exploits across five chains, used for financial crime and targeting devices on older iOS versions such as iOS 13. EPSS assigns a 7.0% probability of exploitation within 30 days (94th percentile).

Do: Upgrade to iOS/iPadOS 15.2, macOS Monterey 12.1, Safari 15.2, tvOS 15.2, and watchOS 8.3; devices on older iOS branches (e.g., iOS 13, targeted by the Coruna exploit kit) should immediately apply Apple's emergency fixes for those versions. On Fedora and Debian, pull the latest WebKitGTK/WPE WebKit security updates through the distro package channels. Federal agencies must meet the BOD 22-01 remediation deadline for this KEV entry, and should inventory for Apple devices that cannot reach a patched version and replace or isolate them.

CVE-2022-48503 is a bounds-checking flaw (CWE-129, improper validation of array index) in the web content processing engine used by Safari and by web views across Apple platforms, rated 8.8 (High) with a network attack vector and user interaction required. An attacker triggers it by getting a victim to process maliciously crafted web content, typically by visiting a hostile webpage, and gains arbitrary code execution in the context of the application rendering that content. Anyone running Safari or iOS, iPadOS, macOS Monterey, tvOS, or watchOS versions prior to the fixed releases (iOS/iPadOS 15.6, macOS Monterey 12.5, Safari 15.6, tvOS 15.6, watchOS 8.7) is affected, with older devices that cannot upgrade at greatest risk. CISA added the bug to its Known Exploited Vulnerabilities catalog on 2025-10-20, confirming exploitation in the wild, and October 2025 reporting on the Coruna iOS exploit kit describes exploit chains being used against older iOS versions. EPSS currently assigns a 3.2% probability of exploitation in the next 30 days (87th percentile); ransomware use is unknown.

Do: Update affected devices to iOS/iPadOS 15.6 or later, macOS Monterey 12.5 or later, Safari 15.6 or later, tvOS 15.6 or later, and watchOS 8.7 or later; for older devices that cannot run these versions, apply Apple's emergency fixes for older iOS releases as reported in recent advisories. Federal agencies must apply vendor mitigations per BOD 22-01 guidance or discontinue use of affected products if mitigations are unavailable. Inventory managed Apple fleets for OS/Safari versions below the fixed releases and treat unpatched devices' web browsing as an unauthenticated code-execution risk until patched.

CVE-2023-32409 is a sandbox escape in Apple's WebKit browser engine, caused by insufficient bounds checking that was corrected in the May 2023 updates. It is triggered remotely when WebKit processes maliciously crafted web content, with no authentication or special user privileges required beyond loading attacker-controlled content (e.g., in Safari or any app rendering web views). A successful attacker breaks out of the Web Content sandbox, weakening the isolation between web content and the rest of the system and enabling further compromise of the device (CVSS assigns a high integrity impact). Anyone running Safari or iOS/iPadOS, macOS Ventura, tvOS, or watchOS versions before the fixed releases is affected, which covers essentially the entire unpatched Apple device base. Apple reports the issue may have been actively exploited, and CISA added it to the Known Exploited Vulnerabilities catalog on 2023-05-22.

Do: Apply the vendor updates per Apple's and CISA's required action: Safari 16.5, iOS/iPadOS 16.5 (or iOS/iPadOS 15.7.8 for users remaining on the iOS 15 branch), macOS Ventura 13.4, tvOS 16.5, and watchOS 9.5. Because WebKit renders web content for all iOS browsers and in-app web views, updating the OS is the primary mitigation; no workaround is documented. Federal agencies must patch within the KEV deadline and should verify fleet-wide OS and Safari versions.

CVE-2023-38606 is a kernel vulnerability in Apple's iOS, iPadOS, macOS, tvOS and watchOS, caused by a state-management defect that allowed an app running on the device to modify sensitive kernel state; Apple fixed it with improved state management in its July 2023 updates. Exploitation is local and requires user interaction (a user must run a malicious app), and successful exploitation lets the attacker alter protected kernel state, with the CVSS scoring high integrity impact but no direct confidentiality or availability loss. Apple stated the issue may have been actively exploited against versions of iOS released before iOS 15.7.1, and CISA added it to the Known Exploited Vulnerabilities catalog on 2023-07-26; related reporting around this period links 2023 Triangulation-campaign exploit code to recent mass attack activity via the 'Coruna' iOS exploit kit. All users of iPhones, iPads, Macs, Apple TVs and Apple Watches running software older than the July 2023 patched releases (iOS 15.7.8/16.6, iPadOS 15.7.8/16.6, macOS 11.7.9/12.6.8/13.5, tvOS 16.6, watchOS 9.6) are affected.

Do: Update all affected devices to the patched releases: iOS 16.6 or iOS 15.7.8, iPadOS 16.6 or 15.7.8, macOS Ventura 13.5 / Monterey 12.6.8 / Big Sur 11.7.9, tvOS 16.6, and watchOS 9.6. No workarounds are documented; because the flaw is triggered by apps, users on unpatched devices should avoid installing or running untrusted apps. The CVE is in the CISA KEV catalog (added 2023-07-26), so federal agencies must apply the vendor fixes within the required BOD 22-01 timelines.

CVE-2023-41974 is a use-after-free (CWE-416) memory-corruption vulnerability in Apple iOS and iPadOS that was addressed with improved memory management. It is triggered locally when an application on the device exercises the affected code path; the CVSS vector (AV:L/UI:R) indicates the attacker needs code running on the device and user interaction, but no network access or privileges. A successful exploit allows an app to execute arbitrary code with kernel privileges, giving the attacker full control over the affected iPhone or iPad. Anyone running iOS/iPadOS versions prior to iOS 17/iPadOS 17, including legacy 15.x devices prior to 15.8.7, is affected. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2026-03-05, and public references tie it to the spy-grade 'Coruna' iOS exploit kit (23 exploits across five chains) used for financial crime, confirming exploitation in the wild.

Do: Update iPhones to iOS 17 and iPads to iPadOS 17, or apply the iOS 15.8.7 / iPadOS 15.8.7 emergency updates on legacy hardware that cannot run 17; inventory your fleet for devices on older builds and prioritize them, since the Coruna exploit kit reportedly targets older iOS versions. Until patched, avoid installing apps from untrusted sources, as exploitation requires running a malicious app. Federal agencies must meet the applicable BOD 22-01 required-action deadline for this KEV entry.

CVE-2023-43000 is a use-after-free vulnerability (CWE-416) in Apple's web content processing (WebKit) that was addressed with improved memory management. It is triggered when a device processes maliciously crafted web content, which per the CVSS vector requires user interaction such as visiting an attacker-controlled page. Successful exploitation causes memory corruption, and the high confidentiality, integrity, and availability scores indicate an attacker can likely gain code execution or data compromise on the target device. Any unpatched user of Safari, iOS, iPadOS, or macOS macOS versions earlier than the fixed releases is affected, including older iOS devices that Apple has now issued emergency updates for. The flaw is being actively exploited: it was added to the CISA Known Exploited Vulnerabilities catalog on 2026-03-05, a public PoC reference ties it to the Coruna iOS exploit kit (a spy-grade kit with 23 exploits used for financial crime), and EPSS estimates a 3.9% chance of exploitation in the next 30 days (90th percentile).

Do: Update affected systems to macOS Ventura 13.5, iOS/iPadOS 16.6, Safari 16.6, or, for older devices still on iOS 15, iOS/iPadOS 15.8.7. Federal agencies under BOD 22-01 must apply vendor mitigations by the KEV deadline or discontinue use of affected products. Because exploitation requires user interaction with crafted web content, prioritize patching internet-facing and at-risk mobile fleets, and warn users to avoid untrusted links as an interim measure.

CVE-2024-23222 is a type confusion flaw (CWE-843) in Apple's WebKit engine that allows arbitrary code execution when a device processes maliciously crafted web content, for example when a user is lured into loading attacker-controlled web pages in Safari or another WebKit-based view (the CVSS vector confirms user interaction is required). It affects a broad slice of the Apple ecosystem: Safari, iPhone OS/iPadOS on the iOS 15, 16 and 17 branches, macOS Monterey/Ventura/Sonoma, tvOS and visionOS, prior to the January 22, 2024 fixes. A successful attacker gains code execution on the target device with high impact on confidentiality, integrity and availability (CVSS 3.1: 8.8). The flaw was fixed in Safari 17.3, iOS/iPadOS 17.3, and backported to iOS/iPadOS 15.8.7 and 16.7.5 for devices that cannot upgrade to iOS 17, plus macOS Monterey 12.7.3, Ventura 13.6.4, Sonoma 14.3, tvOS 17.3 and visionOS 1.0.2. Exploitation is confirmed in the wild: the vulnerability was added to CISA KEV on 2024-01-23, one day after the fixes shipped, and is associated with the Coruna exploit kit, which reportedly chains multiple exploits to target iOS devices including older versions.

Do: Update all affected devices to Safari 17.3, iOS/iPadOS 17.3 (or the iOS/iPadOS 15.8.7 and 16.7.5 backports for devices that cannot run 17), macOS Monterey 12.7.3, macOS Ventura 13.6.4, macOS Sonoma 14.3, tvOS 17.3 and visionOS 1.0.2. Prioritize endpoints used for web browsing and mobile users, since exploitation only requires a user to process crafted web content. The CISA KEV listing (added 2024-01-23) makes applying these vendor updates mandatory under the KEV required action, so verify fleet versions and confirm no devices remain on pre-patch builds.

CVE-2024-23225 is a memory-corruption flaw (CWE-787, out-of-bounds write) in the kernels of Apple's iOS, iPadOS, macOS, tvOS, visionOS and watchOS, addressed with improved memory validation in Apple's March 2024 updates. It is triggered locally (CVSS AV:L/PR:L/UI:N) after an attacker has already obtained arbitrary kernel read and write capability, typically as the final stage of an exploit chain, and requires no user interaction. Successful abuse lets the attacker bypass the kernel's memory protections, converting an existing kernel read/write primitive into deeper and more reliable system compromise. Affected users are those running iPhone/iPad software older than iOS/iPadOS 17.4 (or 16.7.6 on the iOS 16 line), Macs older than macOS Sonoma 14.4 / Ventura 13.6.5 / Monterey 12.7.4, Apple TV units older than tvOS 17.4, Apple Vision Pro units older than visionOS 1.1, and Apple Watch units older than watchOS 10.4. Apple has stated the issue may have been exploited in the wild, CISA added it to the KEV on 2024-03-06 as part of the March 2024 emergency update batch, and EPSS currently assigns a 1.5% probability of exploitation within 30 days (72nd percentile).

Do: Patch immediately to iOS/iPadOS 17.4 (or 16.7.6 for devices that cannot run 17), macOS Sonoma 14.4 / Ventura 13.6.5 / Monterey 12.7.4, tvOS 17.4, visionOS 1.1 and watchOS 10.4; there is no known workaround, so updating is the only mitigation. Because the flaw is KEV-listed, federal agencies must apply the vendor fixes within the BOD 22-01 deadline, and all defenders should verify installed OS versions fleet-wide (e.g., via MDM) and prioritize internet-facing and high-risk users.

Google Chromium contains an out of bounds memory access vulnerability in ANGLE, the graphics translation layer that handles rendering APIs such as WebGL. A remote attacker can trigger the flaw by luring a user to open a crafted HTML page, causing the browser to access memory outside of allocated bounds. Successful exploitation may permit memory disclosure or corruption in the renderer process, although the available data does not fully characterize the impact. Any user of a Chromium-based browser is potentially affected, including users of Google Chrome, Microsoft Edge, and Opera, among other Chromium-derived browsers. The vulnerability was added to CISA's Known Exploited Vulnerabilities catalog on 2025-12-12, indicating active exploitation, while no public proof-of-concept is known and no CVSS score has been assigned yet.

Do: Update all Chromium-based browsers (Google Chrome, Microsoft Edge, Opera, and derivatives) to the latest vendor-released versions and verify the installed browser build on managed endpoints, enabling automatic updates where possible. Because this flaw is in CISA KEV, apply vendor mitigations per vendor instructions or follow applicable BOD 22-01 guidance for cloud services, and prioritize patching internet-facing and high-risk user populations.

CVE-2025-31277 is a memory-handling flaw (buffer overflow, CWE-119/CWE-120) in Apple's WebKit engine, the component that renders web content in Safari and in webviews across Apple platforms. It is triggered when a user processes maliciously crafted web content, typically by visiting an attacker-controlled page, causing memory corruption that can compromise the rendering process, with CVSS 3.1 scoring high impact to confidentiality, integrity and availability (8.8) via a network vector requiring user interaction but no privileges. Everyone running WebKit is affected: Safari users and devices on iOS/iPadOS, macOS Sequoia, tvOS, visionOS and watchOS prior to the fixed releases, plus Linux users of WebKitGTK and WPE WebKit as shipped with Red Hat Enterprise Linux (including the AUS and ELS channels). Exploitation is confirmed in the wild: CISA added the bug to its Known Exploited Vulnerabilities catalog on 2026-03-20 (ransomware linkage unknown) with a BOD 22-01 remediation deadline of 2026-04-03, and contemporaneous reporting describes 'DarkSword', an iOS exploit kit chaining multiple Apple flaws, reportedly including zero-days, in global attacks, possibly including this bug. No public proof-of-concept is known, and fixes shipped in Safari 18.6, iOS/iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6 and watchOS 11.6.

Do: Upgrade Safari to 18.6 or later and apply the corresponding OS updates: iOS/iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6 and watchOS 11.6; on Red Hat Enterprise Linux (including AUS/ELS) install Red Hat's updated WebKitGTK/WPE WebKit packages. Organizations subject to CISA BOD 22-01 must patch or mitigate by the April 3, 2026 deadline. Until patched, restrict WebKit-based browsing and webviews on affected devices to trusted content, since exploitation requires loading maliciously crafted web content.

CVE-2025-43510 is an improper locking flaw (CWE-667) in Apple's operating systems that leads to memory corruption, addressed by improved lock state checking. It is triggered locally: a malicious application already running on the device can cause unexpected changes in memory shared between processes, with the CVSS vector (AV:L, UI:R) indicating user interaction is required but no privileges needed beforehand. Successful exploitation could corrupt or expose cross-process shared memory, yielding high impacts on confidentiality, integrity, and availability (CVSS 3.1 score 7.8), and such shared-memory corruption bugs in Apple's OSes are commonly leveraged as steps in chained attacks such as sandbox escapes. All users of iOS, iPadOS, macOS (Sonoma, Sequoia, and Tahoe branches), tvOS, visionOS, and watchOS on versions earlier than the fixed releases are affected. The vulnerability is being exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-03-20 with a federal patching deadline of April 3, 2026, and news reports describe an active iOS exploit kit ('DarkSword') using multiple Apple flaws, including zero-days, in global attacks.

Do: Update to the fixed releases: iOS/iPadOS 18.7.2 or iOS/iPadOS 26.1; macOS Sonoma 14.8.2, Sequoia 15.7.2, or Tahoe 26.1; tvOS 26.1; visionOS 26.1; and watchOS 26.1. As a local attack vector, prioritize patching devices that install untrusted apps, and federal agencies must apply the fixes under BOD 22-01 by April 3, 2026 per the CISA KEV listing. Given reports of the DarkSword iOS exploit kit chaining multiple Apple flaws in active attacks, treat unpatched iPhones and iPads as high priority and verify OS versions across your fleet.

CVE-2025-43529 is a use-after-free (CWE-416) flaw in Apple's WebKit browser engine, fixed via improved memory management. It is triggered when a device processes maliciously crafted web content, and successful exploitation can lead to arbitrary code execution with network reachability and no privileges required (CVSS 3.1: 8.8, user interaction needed). It affects a broad range of Apple products: Safari, iPhone OS/iOS, iPadOS, macOS, tvOS, visionOS, and watchOS, with fixes delivered in Safari 26.2, iOS/iPadOS 18.7.3 and 26.2, macOS Tahoe 26.2, tvOS 26.2, visionOS 26.2, and watchOS 26.2. Apple reports the issue was exploited in an 'extremely sophisticated' targeted attack against specific individuals on iOS versions before iOS 26, and CISA added it to the Known Exploited Vulnerabilities catalog on 2025-12-15 (a companion CVE-2025-14174 was issued for the same report). No public proof-of-concept is known, and EPSS assigns an 8.9% probability of exploitation within 30 days (95th percentile).

Do: Update affected devices to Safari 26.2, iOS/iPadOS 26.2 (or iOS/iPadOS 18.7.3 on devices that remain on the iOS 18 branch), macOS Tahoe 26.2, tvOS 26.2, visionOS 26.2, and watchOS 26.2, prioritizing mobile users and high-risk targeted individuals. Federal agencies must remediate per CISA BOD 22-01 requirements since the CVE is in the KEV catalog (added 2025-12-15); also review the related CVE-2025-14174 addressed by the same updates. Check device fleet inventory for WebKit-exposed Apple hardware that cannot reach the fixed versions and confirm patches have been applied.

CVE-2026-20700 is a memory corruption (buffer overflow) issue in multiple Apple operating systems that Apple addressed through improved state management. The flaw requires a local attack vector: an attacker who already has some memory-write capability on the device — typically obtained via a chained exploit such as a browser or sandbox escape — can leverage this bug to execute arbitrary code. Attackers gain code execution with the privileges of the compromised component, with high impact on confidentiality, integrity, and availability per the CVSS 7.8 (High) score. All users of iPhone, iPad, Mac, Apple TV, Vision Pro, and Apple Watch running versions earlier than the 26.3 updates are affected. Apple reports the flaw may have been exploited in an extremely sophisticated attack against specific targeted individuals on iOS versions before iOS 26, and CISA added it to the Known Exploited Vulnerabilities catalog on 2026-02-12; related CVEs CVE-2025-14174 and CVE-2025-43529 were issued from the same report.

Do: Update all Apple devices to iOS/iPadOS 26.3, macOS Tahoe 26.3, tvOS 26.3, visionOS 26.3, and watchOS 26.3 or later; the fix also addresses related CVE-2025-14174 and CVE-2025-43529 from the same report. Federal agencies must meet the KEV/BOD 22-01 deadline by patching per vendor instructions or discontinuing affected device use. Given the targeted, exploit-kit-driven attacks (e.g., DarkSword/Coruna tooling reported in the wild), prioritize updates for high-risk users such as executives, journalists, and activists, and verify fleet-wide OS versions rather than assuming patch compliance.