> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # ISC BIND RCE and DoS flaws CVE-2026-94300, 96888, 97313 require urgent patching - URL: https://f4n6.co.uk/security-feed/isc-bind-rce-and-dos-flaws-cve-2026-94300-96888-97313-require-urgent-patching/ - Published: 2026-10-22T16:34:00.000Z - Updated: 2026-10-22T16:34:00.000Z - Author: Jeff Davies - Tags: #security-feed, CVE-2026-94300, CVE-2026-96888, CVE-2026-97313 ## 1\. Executive summary CERT-FR published an advisory on 22 October 2026 covering three ISC BIND vulnerabilities disclosed by ISC the previous day: CVE-2026-94300 (CVSS 8.1 HIGH, CWE-362 race condition and CWE-415 double free), CVE-2026-96888 (CVSS 7.5 HIGH, CWE-476 NULL pointer dereference and CWE-617 reachable assertion) and CVE-2026-97313 (CVSS 7.5 HIGH, CWE-617 reachable assertion). CERT-FR states the flaws allow remote arbitrary code execution and remote denial of service. None of the three is in CISA KEV and EPSS is 1% for CVE-2026-94300 and 0% for the other two, so there is no evidence of exploitation in the wild. Affected are BIND versions before 9.20.30, BIND 9.21.x before 9.21.27, and BIND Supported Preview Edition before 9.20.30-S1\. For EMEA financial services the exposure is concentrated in authoritative and recursive DNS infrastructure: a crash of the named process takes resolution offline for everything behind it, and the memory-safety class of CVE-2026-94300 carries code-execution potential that a DNS server's network position makes worth closing quickly even at low EPSS. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 17 | The flaws permit remote denial of service against the named process, so an unpatched resolver or authoritative server is an ICT-related incident waiting to happen and the incident management process must cover detection and response for DNS outages | Confirm the DNS tier is in scope of the ICT incident management process and that a named-process crash has a documented response path | | DORA Art. 24 | CERT-FR and ISC published the flaws and fixes on 21-22 October 2026, so resilience testing must include validating that the estate is on 9.20.30, 9.21.27 or 9.20.30-S1 | Add a version check for BIND to the testing programme and record the result | | NIS2 Art. 21(2)(d) | BIND is a third-party component in the DNS supply chain and the fix depends on the vendor bulletin | Verify the supplier's patch is applied and that the dependency is tracked in supply chain security measures | ## 3\. Technical analysis & attack chain The source material is a CERT-FR advisory that names the affected versions and the risk categories but does not describe the individual flaw mechanisms. What follows is limited to what CERT-FR, the ISC bulletin references and the CWE classifications support. 1. An attacker reaches a vulnerable BIND instance over the network. CERT-FR classifies all three flaws as remotely exploitable and does not state that authentication is required. 2. For CVE-2026-94300 the flaw is a race condition (CWE-362) that can lead to a double free (CWE-415). Double-free conditions in a memory-unsafe resolver are the class from which remote code execution is typically reached, which is consistent with CERT-FR listing arbitrary code execution as a risk. The advisory does not give the trigger packet or query type. 3. For CVE-2026-96888 the flaw is a NULL pointer dereference (CWE-476) combined with a reachable assertion (CWE-617). Either path terminates the named process, which is the denial of service CERT-FR describes. 4. For CVE-2026-97313 the flaw is a reachable assertion (CWE-617), again terminating the named process. 5. Impact is loss of DNS resolution or authoritative service for every client the instance serves. CERT-FR does not describe persistence, lateral movement, or data access for any of the three. Affected versions, per CERT-FR: BIND Supported Preview Edition before 9.20.30-S1, BIND before 9.20.30, and BIND 9.21.x before 9.21.27\. The fix is the corresponding release from ISC; CERT-FR directs readers to the ISC security bulletins for CVE-2026-94300, CVE-2026-96888 and CVE-2026-97313, all dated 21 October 2026. Context from other national CERTs. BSI rated a BIND multiple-vulnerability advisory hoch (high) and stated a remote anonymous attacker can cause denial of service and possibly execute arbitrary code (WID-SEC-2026-4116). A separate BSI advisory (WID-SEC-2026-0863) and an earlier CERT-FR advisory (CERTFR-2026-AVI-1192, 17 September 2026) cover BIND flaws allowing denial of service, integrity impact and security policy bypass. SecurityWeek reports ISC patched 14 vulnerabilities in a BIND 9 update, with impacts including increased resource usage, unexpected program exit and termination of the named process. These sources do not map their findings to the three CVE identifiers in this advisory, so they are context on the BIND patch cycle, not corroboration of the specific mechanisms above. Treat the mechanism detail for CVE-2026-94300 as single-sourced to the CWE classification and CERT-FR's risk statement; verify against the ISC bulletin before relying on it for detection logic. No threat actor is named in any source and no MITRE ATT&CK profile applies. There is no attribution. ## 4\. Mitigation & containment P1 (within 24 hours) - Inventory every BIND instance and record its version. Anything below 9.20.30, below 9.21.27, or below 9.20.30-S1 in the Supported Preview Edition is vulnerable. Use `named -v` or the package manager (`dpkg -l bind9`, `rpm -q bind`) to confirm. - Patch to 9.20.30, 9.21.27 or 9.20.30-S1 respectively, following the ISC bulletins at https://kb.isc.org/v1/docs/cve-2026-94300, https://kb.isc.org/v1/docs/cve-2026-96888 and https://kb.isc.org/v1/docs/cve-2026-97313\. Where the distribution package lags, pin to the vendor backport and record the version. - Restrict query access to recursive resolvers so only known client networks can reach them. This does not fix the flaws but reduces the population that can trigger them. - Confirm the named process is supervised (systemd unit or equivalent) so a crash restarts automatically, and alert on restart events. P2 (within 72 hours) - Add monitoring for named process exits and assertion failures in the BIND log, and alert on repeated restarts of a single instance. - Review DNS architecture for single points of failure: any resolver or authoritative server whose crash removes resolution for a business service needs a secondary before the next patch cycle. - Where a BIND instance cannot be patched inside 24 hours, isolate it behind a query-rate limit and document the compensating control and the date it will be patched. P3 (within 7 days) - Add BIND version to the asset inventory feed so future ISC bulletins can be matched to the estate without a manual sweep. - Record the patch outcome against DORA Art. 24 testing evidence. ## 5\. Indicators of compromise No indicators of compromise available in the source material. CERT-FR, ISC and the related CERT advisories provide no hashes, network indicators or file artefacts. The observable effect of exploitation is termination or restart of the named process, which is a behavioural signal rather than an atomic indicator. ## 6\. Detection Insufficient indicators to author detection rules. The sources give no distinctive strings, command-line flags, file paths, registry keys or network artefacts specific to these flaws. Detection should rest on the behavioural signal in §4: alert on unexpected named process exits and assertion failures in the BIND log, and on repeated restarts of a single instance. ## CVE assessment 3 referenced CVEs | CVE | CVSS | Exploited | EPSS | Summary | | -------------------------------------------------------------------------------- | -------- | --------- | ---- | -------------------------------------------------------------------------------------------------------------------------------- | | [CVE-2026-94300](https://nvd.nist.gov/vuln/detail/CVE-2026-94300?ref=f4n6.co.uk) | 8.1 High | — | 1% | Replaying GSS-TSIG signed UDP messages can result in memory corruption in "named". An attacker who can capture a previously… | | [CVE-2026-96888](https://nvd.nist.gov/vuln/detail/CVE-2026-96888?ref=f4n6.co.uk) | 7.5 High | — | 0% | A BIND resolver that is configured with both a "redirect" zone and "qname-minimization strict" may abort with an assertion fail… | | [CVE-2026-97313](https://nvd.nist.gov/vuln/detail/CVE-2026-97313?ref=f4n6.co.uk) | 7.5 High | — | 0% | A recursive BIND server that receives a query with recursion desired (RD=1) followed by a non-recursive query (RD=0) may exit w… | ## 7\. Sources - ANSSI CERT-FR, Multiples vulnérabilités dans ISC BIND (CERTFR-2026-AVI-1365), https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1365/, 2026-10-22 - ISC, cve-2026-94300 security bulletin, https://kb.isc.org/v1/docs/cve-2026-94300, 2026-10-21 - ISC, cve-2026-96888 security bulletin, https://kb.isc.org/v1/docs/cve-2026-96888, 2026-10-21 - ISC, cve-2026-97313 security bulletin, https://kb.isc.org/v1/docs/cve-2026-97313, 2026-10-21 - ANSSI CERT-FR, Multiples vulnérabilités dans ISC BIND (CERTFR-2026-AVI-1192), https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1192/, 2026-09-17 - BSI, \[NEU\] \[hoch\] Internet Systems Consortium BIND: Mehrere Schwachstellen (WID-SEC-2026-4116), https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-4116 - BSI, \[UPDATE\] \[mittel\] Internet Systems Consortium BIND: Mehrere Schwachstellen (WID-SEC-2026-0863), https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-0863 - BSI, \[NEU\] \[hoch\] Internet Systems Consortium BIND: Mehrere Schwachstellen (WID-SEC-2026-2484), https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2484 - SecurityWeek, ISC Patches 14 Vulnerabilities in BIND 9 Security Update, https://www.securityweek.com/isc-patches-14-vulnerabilities-in-bind-9-security-update/ - NVD, CVE-2015-5477 (CISA KEV entry, ISC BIND), https://nvd.nist.gov/vuln/detail/CVE-2015-5477 ## 8\. Adverse Trace position Adverse Trace assesses this as a high-priority patching item, not an active threat. The highest CVSS is 8.1 (CVE-2026-94300), none of the three is in CISA KEV, and EPSS is 1% or below, so there is no evidence of exploitation and no actor to attribute. The risk to EMEA financial services is availability of DNS: a crash of the named process removes resolution for everything behind it, and the double-free path in CVE-2026-94300 carries code-execution potential that a DNS server's network position makes worth closing inside 24 hours. The mechanism detail for CVE-2026-94300 rests on the CWE classification and CERT-FR's risk statement, single-sourced; clients should confirm against the ISC bulletin before building detection around it. We will monitor the ISC bulletins and the CISA KEV catalogue for a change in exploitation status and reissue this advisory if either moves. Clients should confirm their BIND versions against 9.20.30, 9.21.27 and 9.20.30-S1 and report the result to their Adverse Trace contact. --- [Read the original source →](https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1365/?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*