Article
BIND 9 CVE-2026-94300: Fixed Versions and How to Check Your Exposure
ISC fixed a BIND 9 vulnerability in GSS-TSIG that can corrupt memory and may allow code execution. Fixed versions, who is exposed and a…
Read more
Vulnerability
ISC BIND 9 GSS-TSIG memory corruption (CVE-2026-94300)
A memory corruption flaw in the GSS-TSIG handling of the BIND 9 name server.
- CVE ID
- CVE-2026-94300
- CVSS
- 8.1 High (CVSS v3.1, ISC)
- Affected product
- BIND 9 and BIND 9 Supported Preview Edition
- Exploited
- Unknown
- Published
- 21 October 2026
In short
CVE-2026-94300 is a memory corruption flaw in the GSS-TSIG handling of the BIND 9 name server. ISC says replaying a signed GSS-TSIG UDP message while its key is valid, together with crafted queries to a zone the attacker controls, may lead to remote code execution. ISC rates it High with a CVSS score of 8.1 and fixed it in 9.20.30, 9.21.27 and 9.20.30-S1 on 21 October 2026.
- CVECVE-2026-94300
- ProductISC BIND 9 and BIND 9 Supported Preview Edition
- Fix Steps4actions listedCheck the version · Upgrade
What it allows
ISC says an attacker who has captured a previously signed GSS-TSIG UDP message can replay it while the negotiated TSIG key is still valid. By also sending crafted queries to a zone the attacker controls, the attacker may potentially achieve remote code execution in the named process. The impact ISC lists is memory corruption, leading to program abort and/or potential remote code execution.
The CVSS vector is network, high attack complexity, no privileges and no user interaction. Red Hat rates it Important rather than Critical because exploitation depends on capturing active keys within their validity window.
Red Hat adds that BIND on Red Hat Enterprise Linux does not enable GSS-TSIG by default. The risk is mainly for servers tied to Kerberos identity systems such as FreeIPA or Active Directory. Read our BIND 9 fixed versions and exposure check for the patched releases and how to check a server.
Who is affected
BIND 9.11.0 to 9.18.50, 9.20.0 to 9.20.29 and 9.21.0 to 9.21.26. Supported Preview Edition 9.11.3-S1 to 9.18.50-S1 and 9.20.9-S1 to 9.20.29-S1. Fixed in 9.20.30, 9.21.27 and 9.20.30-S1.
ISC lists no fixed 9.18 release, and its download page shows 9.18 as end of life, with 9.18.50 as the last release. Distribution builds use their own numbers: the Debian tracker shows trixie fixed in 1:9.20.30-1~deb13u1 and bookworm (9.18) as vulnerable.
Timeline
- 20 May 2026
ISC fixes CVE-2026-3039, a memory exhaustion flaw in GSS-API TKEY negotiation, in 9.18.49, 9.20.23 and 9.21.22.
- 14 Oct 2026
ISC's revision history lists an early notification for CVE-2026-94300.
- 21 Oct 2026
ISC publishes the advisory and releases 9.20.30, 9.21.27 and 9.20.30-S1. The CVE record is published the same day.
- 21 Oct 2026
The CISA coordinator entry marks exploitation as none, automatable as no and technical impact as total. The CISA KEV release of 14:04 UTC does not list the CVE.
- 22 Oct 2026
JPRS and CERT.LV post alerts on X.
What to do
-
Check the version
Run named -v for the installed version and rndc version for the running one. Anything in the affected ranges needs the upgrade.
-
Look for GSS-TSIG in the configuration
Run named-checkconf -p -x and search for tkey-gssapi-keytab and tkey-gssapi-credential, the directives Red Hat names. Servers with either one go first.
-
Upgrade
Move to 9.20.30, 9.21.27 or 9.20.30-S1, or to your distribution's fixed build, then restart named and confirm the running version.
-
Know the limits of a stopgap
ISC lists no workarounds. Red Hat suggests removing the GSS-TSIG directives or limiting port 53 to trusted networks. That can break Kerberos-authenticated dynamic DNS in Active Directory or IdM setups.
Questions
What is CVE-2026-94300?
It is a memory corruption flaw in how BIND 9 handles GSS-TSIG messages. ISC says it may allow remote code execution and rates it High, CVSS 8.1.
Which versions fix it?
BIND 9.20.30, 9.21.27 and the Supported Preview Edition 9.20.30-S1. ISC lists no fixed 9.18 release.
Do I need to use Active Directory to be affected?
ISC does not name the needed configuration. Red Hat says the risk is for servers that negotiate GSS-TSIG keys, such as those tied to FreeIPA or Active Directory. Check for tkey-gssapi-keytab.
Is it exploited in the wild?
ISC says it knows of no active exploits, and the CISA catalog did not list it in its 21 October release.
In our research
- BIND 9 CVE-2026-94300: Fixed Versions and How to Check Your Exposure October 2026
- DNS Under Siege: Analysis of Threat Actor-Driven Abuse February 2024
- Active Directory Glossary term
- GSS-TSIG Glossary term
- Patch management Glossary term
Sources
- CVE-2026-94300: Concurrent GSS-TSIG messages corrupt memory ISC
- CVE-2026-94300 CVE Program
- CVE-2026-94300 Red Hat
- CVE-2026-94300 Debian Security Tracker
- BIND 9 Software Vulnerability Matrix ISC
- Known Exploited Vulnerabilities catalog CISA
- CWE-415: Double Free MITRE
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 51 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 26 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 57 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 41 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 60 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 107 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.