BIND 9: four CVEs, one may lead to remote code execution

On 21 October 2026 the Canadian Centre for Cyber Security published advisory AV26-1072 on four vulnerabilities in BIND 9, the DNS server from Internet Systems Consortium (ISC) that is widely deployed on Linux and Unix, both as an internal resolver and as an authoritative server. The next day CERT.LV, Latvia’s national CERT, picked up the news and added severity scores and fixed versions, and heise Security covered it under a headline describing a flaw that lets attackers smuggle code into the name server.

The most serious one is CVE-2026-94300: according to CERT.LV, under certain conditions it may allow an attacker to execute arbitrary code remotely. The other three can disrupt the DNS service or exhaust its resources. None of the sources reports active exploitation at the time of writing.

The four vulnerabilities

The CVE titles are taken from the Canadian advisory; the CVSS scores come from CERT.LV.

• CVE-2026-94300 – concurrent GSS-TSIG messages corrupt memory. CVSS 8.1. This is the one that, according to CERT.LV, may lead to remote code execution.
• CVE-2026-19630 – amplified resource exhaustion in inbound message processing. CVSS 7.5.
• CVE-2026-96888 – named may terminate unexpectedly when a redirect zone is used together with strict QNAME minimization. CVSS 7.5.
• CVE-2026-97313 – specific RPZ (Response Policy Zone) configurations combined with certain query patterns may cause the process to exit unexpectedly. CVSS 7.5.

CERT.LV describes one of the vulnerabilities as “critical” and the others as high severity; however, the highest score it gives is 8.1, which on the CVSS scale corresponds to high severity. For the other three CVEs the effects described are DNS server malfunction, excessive CPU and memory consumption, or denial of service.

Some context to understand who is exposed. GSS-TSIG is the variant of TSIG based on GSS-API and Kerberos: in BIND it is mainly used for authenticated dynamic updates, typical of environments integrated with Active Directory, and it is enabled with options such as tkey-gssapi-keytab or tkey-gssapi-credential. Redirect zones are used to give custom answers to queries for non-existent names; RPZ is the mechanism a resolver uses to apply block lists, for example in a DNS firewall. The available sources do not say whether the CVEs tied to these features also affect servers that do not use them: check ISC’s advisory for each CVE.

Affected versions and fixes

According to the Canadian advisory, the following are affected:

• BIND 9: 9.11.0 to 9.18.50 and 9.21.0 to 9.21.26;
• BIND Supported Preview Edition: 9.11.3-S1 to 9.18.50-S1 and 9.20.9-S1 to 9.20.29-S1.

CERT.LV also lists the 9.20 branch among those affected and names 9.20.30 and 9.21.27 as the fixed versions, which ISC urges users to install as soon as possible. The available sources do not give a fixed version for the 9.18 branch or for the Supported Preview Edition, and they do not say which versions are affected by each CVE: the Canadian advisory points to the BIND 9 Security Vulnerability Matrix published by ISC, which remains the reference.

Impact for European and Italian companies

BIND runs in the internal resolvers of many companies, in the authoritative servers of providers and hosting firms, in Linux distributions and in appliances that embed it. When DNS stops, email, web applications, VPNs and internal services effectively stop too, even if the application servers are healthy. Remotely exploitable memory corruption is a different level of risk: the DNS server often holds a privileged position in the network, with visibility over every lookup.

Under NIS2, DNS service providers are explicitly listed among digital infrastructure; in Italy the directive was transposed by Legislative Decree 138/2024. For other entities, a DNS outage that blocks essential services may become an incident to assess for notification to the national CSIRT, which in Italy is CSIRT Italia at the ACN. In healthcare, where clinical systems also depend on internal name resolution, this is a matter of operational continuity.

What to do now

1. Take inventory of the systems running named: internal resolvers, authoritative servers exposed to the Internet, appliances that embed BIND. named -v shows the installed version.
2. Update to the fixed version of your branch: 9.20.30 or 9.21.27 according to CERT.LV. For the 9.18 branch and the -S1 editions, check ISC’s advisory. If you use packages from a Linux distribution, the distribution’s bulletin is authoritative, as fixes are often backported without changing the main version number.
3. Prioritise servers that use GSS-TSIG, RPZ or redirect zones with strict QNAME minimization. A quick configuration check: named-checkconf -p | grep -E 'tkey-gssapi|response-policy|qname-minimization|type redirect'.
4. Reduce exposure: recursive resolvers should answer only internal clients (allow-recursion), and dynamic updates should come only from authorised systems. These are general good practices, not workarounds given by the sources: for any workaround, ISC is the reference.
5. Detect: watch for unexpected crashes and restarts of named and for CPU and memory spikes on DNS servers. In MITRE ATT&CK terms, exploitation would fall under T1190 (Exploit Public-Facing Application) for code execution and T1499.004 (Application or System Exploitation) for denial of service.

How ARXDOME helps

ARX Shield shows open vulnerabilities by machine and by package, so you can quickly find servers running BIND versions that need updating. ARX Expose and ARX Scout tell you which of your company’s DNS services are reachable from the Internet: the former from public sources, the latter with an authorised check of ports and services. ARX Sentry collects logs and events from Linux servers, so an unexpected crash of named does not go unnoticed.

Last updated: 22 October 2026