The Internet Systems Consortium has patched 14 vulnerabilities in BIND 9, the software running a large share of the internet’s authoritative and recursive DNS servers. Seven are rated high severity and can be triggered remotely to crash the service or exhaust memory and CPU. The other seven, rated medium, can lead to cache poisoning, excessive resource usage, or arbitrary data being injected into DNS zones. Fixes ship in BIND 9.21.26 and 9.20.29, and ISC has seen no evidence of active exploitation so far.
Why “no active exploitation yet” is not a reason to wait
DNS sits underneath almost everything else you run. A resolver that can be crashed on demand is a denial-of-service switch for every service that depends on it resolving names correctly, and a resolver vulnerable to cache poisoning can be tricked into sending your users to an attacker’s infrastructure instead of your own, quietly and without anyone noticing until something downstream breaks. The high-severity crash bugs alone (CVE-2026-80274, CVE-2026-76163, CVE-2026-19666, CVE-2026-81563, CVE-2026-77692, CVE-2026-19667, and CVE-2026-81736) are enough to take a resolver fleet down with a handful of crafted queries.
Fourteen flaws in one release is also a reminder that DNS server software gets far less scrutiny from most security teams than the applications sitting behind it, despite being just as internet-facing and, in a lot of environments, considerably older and less monitored.
What to do now
- Patch to 9.21.26 or 9.20.29 on your own schedule rather than waiting for a KEV listing. ISC has a track record of finding these issues before attackers do, which is exactly the window you want to use.
- If you run your own authoritative or recursive resolvers, get them looked at directly. External network penetration testing that actually targets DNS infrastructure, rather than treating it as out of scope, catches exactly this kind of forgotten attack surface.
- Confirm your resolvers are not reachable from the open internet unless they genuinely need to be, and check that with a proper firewall configuration review rather than assuming last year’s rules still hold.
- If DNS integrity is part of a regulated obligation for your sector, fold this patch cycle into your NIS2 and DORA readiness evidence rather than treating it as a routine IT ticket.
The takeaway
Fourteen bugs in the software resolving every hostname your business depends on is a bigger deal than the CVSS scores on any individual one of them suggest. Patch on ISC’s schedule, not the schedule of whoever finds the first working exploit.