Vulnerabilities
Multiple CVEs in ISC BIND Threaten DNS Integrity and Availability – Immediate Patch Required
On 17 September 2026 the French CERT revealed a bundle of seven critical flaws in ISC BIND DNS server software. The CVEs – CVE‑2026‑75029, CVE‑2026‑76163, CVE‑2026‑77119, CVE‑2026‑77692, CVE‑2026‑78301, CVE‑2026‑80274, CVE‑2026‑81563 and CVE‑2026‑81736 – enable remote denial‑of‑service, data‑tampering and policy bypass. Affected releases include BIND 9.20.29‑S1 preview and earlier, 9.21.x before 9.21.26 and 9.20.29 before that version. Immediate patching or upgrade to 9.21.26+ is mandatory to protect DNS infrastructure.
On 17 September 2026, the French CERT announced a wave of critical flaws in ISC BIND DNS server software. A combination of seven CVEs—CVE‑2026‑75029, CVE‑2026‑76163, CVE‑2026‑77119, CVE‑2026‑77692, CVE‑2026‑78301, CVE‑2026‑80274, CVE‑2026‑81563, CVE‑2026‑81736—allows an attacker to trigger remote denial‑of‑service, tamper with zone data, and bypass configured security policies.
Vulnerability Impact
- Remote DoS – attackers can exhaust CPU or memory, causing BIND to become unresponsive.
- Data Integrity – malicious responses can be injected into zone transfers, corrupting authoritative data.
- Policy Bypass – certain ACLs and TSIG checks can be circumvented, letting attackers query or modify zones without permission.
Affected Versions
- BIND 9.20.29‑S1 preview and earlier
- BIND 9.21.x earlier than 9.21.26
- BIND 9.20.29 and earlier
Mitigation
All users of the affected releases should upgrade to the latest BIND 9.21.26 or later. If an upgrade is not immediately possible, apply the individual patches published by ISC for each CVE. Verify that TSIG and ACL configurations are still enforced after patching.
“The combination of these flaws represents a significant risk to DNS infrastructure worldwide. Prompt remediation is essential to maintain service availability and data integrity.” – CERT‑FR Advisory
Related vulnerabilities
CVE-2026-12345: CPython Data Integrity Vulnerability – Immediate Patch Required
A critical data‑integrity flaw (CVE‑2026‑12345) was disclosed in CPython, allowing attackers to corrupt program state. Systems running unpatched CPython versions are at risk. Apply the PSF‑2026‑42 patch and verify the update immediately.
Read briefing
CVE-2026-70274: Windows Bind Filter Driver Local Privilege Escalation
A use‑after‑free flaw in the Windows Bind Filter Driver allows an authenticated local user to elevate privileges. Microsoft has released a patch; defenders should apply it immediately and verify driver integrity.
Read briefing
OpenOffice Versions <4.1.17 Vulnerable to Remote Code Execution (CVE‑2026‑59265, CVE‑2026‑63277)
Multiple CVEs have been identified in OpenOffice versions older than 4.1.17 that enable remote code execution. The flaws allow an attacker to trigger arbitrary code on a target system via crafted documents. Defenders must apply the vendor’s patches immediately or upgrade to a supported release.
Read briefing
Windows Overlay Filter RCE Vulnerability (CVE‑2026‑69959) – Immediate Patch Required
Microsoft has disclosed a high‑severity out‑of‑bounds read in the Windows Overlay Filter that allows an authorized user to execute arbitrary code locally. The flaw is fixed in the latest security update; administrators must apply the patch and verify system integrity.
Read briefing