ISC BIND CVE-2015-5477: TKEY query DoS added to CISA KEV

On 8 October 2026 CISA added CVE-2015-5477, a vulnerability in ISC BIND, to its Known Exploited Vulnerabilities (KEV) catalog. BIND is a widely used DNS server on Linux and Unix systems and is also bundled in several third-party products. The flaw lets a remote, unauthenticated attacker make the named daemon exit by sending TKEY queries. The result is a denial of service: the server stops answering DNS requests.

The vulnerability is not new: it was published in July 2015 and fixed by the vendor at the time. The KEV catalog, however, lists vulnerabilities for which CISA has evidence of active exploitation. Its inclusion is therefore a signal to take seriously for anyone still running unpatched BIND installations.

What happened

CISA added CVE-2015-5477 to KEV as “ISC BIND Data Processing Errors Vulnerability” and set 11 October 2026 as the deadline for US federal agencies: three days, a very short window. The catalog lists its use in ransomware campaigns as “unknown”.

The advisory asks agencies to apply mitigations according to the vendor’s instructions, in line with Binding Operational Directive BOD 26-04 on prioritising updates by risk and with CISA’s forensics triage requirements. If mitigations are not available, the product must be discontinued. The advisory also asks to assess the internet exposure of every asset.

CISA does not explain why the vulnerability is only being added now, and gives no details about the attacks observed, the attackers or the victims.

Technical details

• CVE: CVE-2015-5477, published on 29 July 2015. The NVD entry was updated on 9 October 2026.
• Affected product and versions: named in ISC BIND 9.x before 9.9.7-P2 and BIND 9.10.x before 9.10.2-P3.
• Fixed versions: 9.9.7-P2 and 9.10.2-P3, or later.
• Vector: network, through DNS queries of type TKEY. TKEY queries are used for key exchange between DNS clients and servers.
• Effect: an internal REQUIRE check fails (assertion failure) and the named daemon exits. DNS service stays down until the process is restarted.
• Severity: CVSS 3.1 7.5 (high), AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The attack is over the network, of low complexity, needs no privileges or user interaction and affects availability only. CVSS 2: 7.8 (high).
• Weaknesses: CWE-617 (reachable assertion) and CWE-19 (data processing errors).
• Public code: the NVD references include a Packet Storm page titled “BIND TKEY Query Denial Of Service”.
• Related advisories: the NVD entry also lists advisories from Red Hat, Debian, Fedora, openSUSE, Oracle and Juniper. BIND therefore also ships in Linux distributions and third-party products, which published their own fixes.
• MITRE ATT&CK: T1499.004 (Endpoint Denial of Service: Application or System Exploitation).

Impact for European and Italian companies

DNS is a service almost everything depends on: email, web applications, remote access, internal services. If the DNS server stops, so do the services that rely on the names it resolves. The damage is to availability: the CVE does not affect data confidentiality or integrity.

The most exposed systems are the ones nobody has updated for years. For example old internal DNS servers, forgotten virtual machines or appliances that include BIND without making it obvious.

For NIS2 entities the issue has two sides. DNS service providers are explicitly within the scope of the directive, among digital infrastructure. For everyone else, a DNS outage that interrupts essential services may become an incident to assess for notification to the national CSIRT, which in Italy is CSIRT Italia at ACN. In healthcare, where clinical systems also depend on internal name resolution, DNS unavailability is a business continuity issue.

What to do right now

1. Take inventory: find every system running named, including internal DNS servers, internet-facing ones and appliances that include BIND.
2. Check versions: BIND 9.9 installations before 9.9.7-P2 and BIND 9.10 installations before 9.10.2-P3 are vulnerable. If you use a Linux distribution’s packages, check the status against the distribution’s advisory, not just the version number.
3. Update: install the fixed version indicated by the vendor or the distribution maintainer. If you still find BIND branches from that era, consider moving to a version the vendor still supports.
4. For third-party appliances, follow the supplier’s advisory. If no fix exists, CISA says to discontinue the product.
5. Reduce exposure: check which DNS servers answer queries from the internet and whether they really need to.
6. Detect: monitor unexpected stops and restarts of named and search the logs for assertion failure messages followed by the process exiting.

How ARXDOME helps

ARX Shield shows open vulnerabilities by machine and by package and highlights those already exploited by attackers, such as the CVEs in the KEV catalog: it helps you quickly find servers with BIND versions to update. ARX Expose checks the services your company exposes on the internet and the known vulnerabilities of the products it recognises. ARX Sentry collects logs and events from Linux servers, so an abnormal stop of the DNS service does not go unnoticed.

Last updated: 8 October 2026