ISC has released fixes for four high-severity BIND 9 vulnerabilities disclosed on 21 October 2026. The most serious, CVE-2026-94300, can corrupt memory and potentially enable remote code execution via replayed GSS-TSIG signed UDP messages. The other three flaws primarily enable denial of service, either by exhausting CPU and memory or by causing crashes in resolvers. ISC states there are no known active exploits at the time of disclosure.
Affected products and practical response are outlined by ISC and mirrored in vendor advisories. The vulnerabilities affect BIND 9.11.0 or 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, and matching BIND Supported Preview Edition (-S1). Patches are available in BIND 9.20.30, 9.21.27, or 9.20.30-S1 for Preview Edition users.
ISC also recommends moving away from BIND 9.18, which has no fixed release listed, and reviewing RPZ and redirect zone configurations on resolvers, as there are no workarounds. Exploitation status across all four flaws is listed as “not exploited” by ISC, with no public PoCs confirmed. Overall, upgrading to the fixed releases is presented as the primary mitigation path to close these vulnerabilities.