Skip to main content

ISC BIND 9 CVE-2026-10723

| EUVDEUVD-2026-47704 MEDIUM
Improper Verification of Cryptographic Signature (CWE-347)
2026-07-22 isc GHSA-4fw4-hmvf-4www
Information Disclosure Jwt Attack Bind 9 Red Hat Suse
6.8
CVSS 3.1 · Vendor: isc
Share

Severity by source

Vendor (isc) PRIMARY
6.8 MEDIUM
AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N
vuln.today AI
6.8 MEDIUM

Child-zone control or in-path DNS injection required (AC:H); no auth to BIND needed (PR:N); forged NXDOMAIN is pure integrity impact propagating to DNS clients (S:C, I:H, C:N, A:N).

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N
SUSE
MEDIUM
qualitative
Red Hat
6.8 MEDIUM
qualitative

Primary rating from Vendor (isc).

CVSS VectorVendor: isc

Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
None
Integrity
High
Availability
None

Lifecycle Timeline

2
Analysis Generated
Jul 22, 2026 - 15:16 vuln.today
CVE Published
Jul 22, 2026 - 14:08 cve.org
MEDIUM 6.8

DescriptionCVE.org

BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge authenticated NXDOMAIN responses. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.

AnalysisAI

DNSSEC integrity bypass in ISC BIND 9 enables network-positioned attackers to forge authenticated NXDOMAIN responses by exploiting improper validation of NSEC3 records originating from child zones. Affected are BIND 9 versions across the 9.18, 9.20, and 9.21 branches, as well as the BIND 9 Supported Preview Edition (S-series). Because the CVSS vector carries S:C (scope changed), the integrity impact propagates beyond the resolver itself to any DNS client trusting BIND's DNSSEC-validated answers. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.

Technical ContextAI

NSEC3 (Next Secure version 3, RFC 5155) is the DNSSEC mechanism for authenticated denial of existence - it allows a resolver to cryptographically confirm that a queried name does not exist in a zone without enumerating all zone names. BIND 9 (CPE: cpe:2.3:a:isc:bind_9) acts as a validating recursive resolver and must verify that NSEC3 records supplied by authoritative child zones are correctly signed and within scope. CWE-347 (Improper Verification of Cryptographic Signature) identifies the root cause: BIND fails to adequately validate that child-zone NSEC3 records meet the chain-of-trust requirements before accepting them, allowing an adversary who controls a child zone or can inject DNS responses to present NSEC3 records that BIND erroneously treats as valid proof of non-existence. The 'Jwt Attack' tag in the source intelligence appears inconsistent with the described vulnerability and the DNSSEC protocol stack; it is treated as a mislabeled artifact and not relied upon in this analysis.

RemediationAI

The primary remediation is upgrading to a patched release issued by ISC. For the 9.20 branch, upgrade to 9.20.26 or later, available at https://downloads.isc.org/isc/bind9/9.20.26. For the 9.21 branch, upgrade to 9.21.24 or later, available at https://downloads.isc.org/isc/bind9/9.21.24. A patched release for the 9.18 branch and the S-series Preview Editions is referenced in the ISC advisory at https://kb.isc.org/docs/cve-2026-10723 but a specific version number for those branches is not confirmed in the available patch references; consult the ISC advisory directly for S-series guidance. Where immediate upgrade is not feasible, operators can reduce exposure by restricting which zones BIND is permitted to accept delegations from and by ensuring DNSSEC validation paths do not traverse untrusted or third-party-controlled child zones. Disabling DNSSEC validation entirely would eliminate this attack path but removes all DNSSEC integrity guarantees - this trade-off should only be accepted as a short-term measure in isolated environments.

More in Jwt Attack

View all
CVE-2013-3900 MEDIUM
5.5 Dec 11

Why is Microsoft republishing a CVE from 2013? We are republishing CVE-2013-3900 in the Security Update Guide to update

CVE-2026-48558 CRITICAL POC
9.5 Jun 12

Authentication bypass in SimpleHelp 5.5.15 and prior (plus 6.0 pre-release builds) allows remote unauthenticated attacke
CVE-2025-59718 CRITICAL
9.8 Dec 09

Authentication bypass in Fortinet FortiOS, FortiProxy, and FortiSwitchManager allows unauthenticated remote attackers to
CVE-2025-25291 CRITICAL POC
9.3 Mar 12

ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Rated critical severity (CVS
CVE-2025-25292 CRITICAL POC
9.3 Mar 12

ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Rated critical severity (CVS
CVE-2022-25898 CRITICAL POC
9.8 Jul 01

The package jsrsasign before 10.5.25 are vulnerable to Improper Verification of Cryptographic Signature when JWS or JWT

CVE-2024-42004 CRITICAL POC
9.8 Dec 18

A library injection vulnerability exists in Microsoft Teams (work or school) 24046.2813.2770.1094 for macOS. Rated criti
CVE-2024-41145 CRITICAL POC
9.8 Dec 18

A library injection vulnerability exists in the WebView.app helper app of Microsoft Teams (work or school) 24046.2813.27
CVE-2024-41138 CRITICAL POC
9.8 Dec 18

A library injection vulnerability exists in the com.microsoft.teams2.modulehost.app helper app of Microsoft Teams (work

CVE-2024-45409 CRITICAL POC
9.8 Sep 10

The Ruby SAML library is for implementing the client side of a SAML authorization. Rated critical severity (CVSS 9.8), t
CVE-2022-35929 CRITICAL POC
9.8 Aug 04

cosign is a container signing and verification utility. Rated critical severity (CVSS 9.8), this vulnerability is remote
CVE-2022-31053 CRITICAL POC
9.8 Jun 13

Biscuit is an authentication and authorization token for microservices architectures. Rated critical severity (CVSS 9.8)

Same weakness CWE-347 – Improper Verification of Cryptographic Signature

View all
CVE-2013-3900 MEDIUM
5.5
CVE-2026-48558 CRITICAL POC
9.5
CVE-2025-59718 CRITICAL
9.8
CVE-2025-47827 MEDIUM POC
4.6
CVE-2025-25291 CRITICAL POC
9.3
CVE-2025-25292 CRITICAL POC
9.3
CVE-2022-25898 CRITICAL POC
9.8
CVE-2024-42004 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise Module for Basesystem 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed
SUSE Linux Enterprise Module for Server Applications 15 SP7 Fixed
openSUSE Leap 16.0 Fixed
openSUSE Tumbleweed Fixed

Share

CVE-2026-10723 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy