Week of March 2, 2026: CISA KEV Surge, Cisco SD-WAN Exploits, and Coruna iOS Spyware

Security leaders saw CISA add seven actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog, Cisco confirm exploitation of two Catalyst SD-WAN Manager flaws alongside a 48-bug firewall patch batch, and Google detail the Coruna iOS exploit kit that moved from commercial surveillance use into cybercriminal hands. The UK government also reported sharp drops in public-sector vulnerability fix times, Microsoft detailed an OAuth redirection abuse campaign targeting government agencies, and newly disclosed flaws in IceWarp and FreeScout collaboration software left thousands of internet-facing servers exposed.

CISA Adds Five Actively Exploited Vulnerabilities to KEV Catalog

CISA added five vulnerabilities to its Known Exploited Vulnerabilities catalog on March 5, 2026, citing evidence of active exploitation. The list included a Hikvision authentication flaw (CVE-2017-7921), a Rockwell credential-protection issue (CVE-2021-22681), and three Apple vulnerabilities (CVE-2021-30952, CVE-2023-41974, CVE-2023-43000) affecting iOS, iPadOS, and other Apple products. Federal civilian agencies operate under Binding Operational Directive 22-01, which sets remediation deadlines for catalog entries, and CISA urged all organizations to prioritize patching these flaws given their history as frequent attack vectors. (CISA)

CISA Flags Qualcomm and Broadcom VMware Flaws as Exploited

Two days earlier, on March 3, 2026, CISA added a Qualcomm chipset memory-corruption vulnerability (CVE-2026-21385) and a Broadcom VMware Aria Operations command-injection flaw (CVE-2026-22719) to its Known Exploited Vulnerabilities catalog after confirming active exploitation. Both vulnerabilities fall under Binding Operational Directive 22-01, which requires federal civilian agencies to remediate by set deadlines. CISA again urged all organizations, not only federal agencies, to treat timely remediation of catalog entries as a core part of vulnerability management practice given ongoing attacker interest in these products. (CISA)

UK Government Cuts Public-Sector Patch Times With New Vulnerability Monitoring Service

The UK government disclosed that its vulnerability monitoring service, part of the Blueprint for Modern Digital Government, had cut the median time to fix domain-related vulnerabilities from nearly two months to eight days, and other vulnerability types from 53 days to 32 days. The service scans roughly 6,000 public sector organizations and resolves about 400 confirmed vulnerabilities monthly. Minister for Digital Government Ian Murray said fix times had been cut by 84%. NCSC CEO Richard Horne tied the results to a new government Cyber Profession initiative aimed at building long-term cyber skills. (Help Net Security)

Google Uncovers Coruna, a Spy-Grade iOS Exploit Kit Reused by Cybercriminals

Google's Threat Intelligence Group published research describing Coruna, an iOS exploit kit containing five exploit chains and 23 exploits that moved from a commercial surveillance vendor to state-linked espionage operations and then to financially motivated hackers. Researchers first observed it in February 2025, later in watering-hole attacks against Ukrainian sites, and by December 2025 via fake gambling and crypto websites targeting ordinary iPhone users. CISA subsequently added three of the exploited CVEs, including CVE-2023-43000, to its Known Exploited Vulnerabilities catalog on March 6, 2026. (Help Net Security)

Cisco Confirms Active Exploitation of SD-WAN Manager Flaws, Patches 48 Firewall Bugs

Cisco confirmed on March 5, 2026, that attackers were exploiting two Catalyst SD-WAN Manager vulnerabilities, CVE-2026-20128 and CVE-2026-20122, that had already been patched. The former allows a local attacker with valid credentials to gain Data Collection Agent privileges; the latter lets authenticated remote attackers overwrite files and gain vmanage privileges. The same day, Cisco fixed 48 vulnerabilities across Secure Firewall ASA, FMC, and FTD software, including two maximum-severity flaws, CVE-2026-20079 and CVE-2026-20131. The Dutch National Cyber Security Center warned a public proof-of-concept and mass exploitation attempts were likely soon. (Help Net Security)

Microsoft Warns of OAuth Redirect Abuse Targeting Government Agencies

Microsoft researchers disclosed an ongoing phishing campaign that manipulates OAuth authentication redirection to bypass conventional email and browser defenses. Attackers targeting government and public-sector organizations crafted authorization requests with invalid parameters, triggering legitimate identity-provider redirects that silently sent victims from genuine sign-in pages to attacker-controlled sites serving credential-phishing pages or malware. Microsoft Entra disabled the observed malicious OAuth applications, but the company said related activity persisted and recommended organizations limit user consent, review application permissions, and remove unused or overprivileged apps. (Help Net Security)

Over 1,200 IceWarp Servers Remain Exposed to Unauthenticated RCE Flaw

The Shadowserver Foundation reported that more than 1,200 internet-facing IceWarp collaboration servers remained unpatched against CVE-2025-14500, a critical OS command-injection vulnerability in the platform's handling of the X-File-Operation header. The flaw requires no authentication and lets remote attackers execute arbitrary commands with SYSTEM or root privileges on Windows or Linux deployments. IceWarp fixed the bug in October 2025 across multiple product generations, but Shadowserver was alerting owners of unpatched on-premises instances to update as of March 4, 2026. No in-the-wild exploitation had been reported. (Help Net Security)

FreeScout Patch Bypass Enables Zero-Click Takeover via Malicious Email

Researchers at OX Security disclosed CVE-2026-28289, a bypass of an earlier FreeScout fix that let attackers achieve unauthenticated, zero-click remote code execution by sending a single crafted email to a FreeScout help-desk mailbox. The flaw abused a Unicode zero-width space character to sneak a malicious .htaccess file past filename validation on Apache servers configured with AllowOverride All. Shodan showed roughly 1,100 publicly exposed FreeScout instances as of the disclosure. FreeScout's v1.8.207 fixed the bypass, and researchers also advised disabling AllowOverrideAll. (Help Net Security)