ISC BIND 9 CVE-2026-10723

Exploitation requires the attacker to control a DNS zone that has been delegated as a child zone within the resolution path of the targeted BIND resolver, or to occupy an in-path network position capable of injecting DNS responses carrying forged NSEC3 records. The target resolver must be performing DNSSEC validation (the default in most current BIND 9 deployments, but configurable). No authentication to BIND itself is required - the attacker operates at the DNS protocol layer. Exploitation is limited by the AC:H requirement: opportunistic mass exploitation is not feasible without child-zone control or a MitM capability on DNS traffic. Environments where BIND resolves names in zones with third-party-controlled child delegations or where DNS traffic crosses untrusted network segments face the highest realistic exposure.

The NVD CVSS 3.1 score of 6.8 (AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N) reflects a genuine but conditionally exploitable integrity threat. AC:H is the key moderating factor: exploitation is not straightforward and requires the attacker to occupy a privileged network position - either controlling a child DNS zone that the target BIND resolver will query, or intercepting DNS traffic in-path. The S:C flag elevates the score beyond what the base BIND compromise alone would justify, correctly capturing that the downstream impact falls on DNS clients that receive and act upon forged NXDOMAIN responses, potentially blocking access to legitimate domains or facilitating misdirection. No EPSS score was provided in the source data, limiting quantitative exploitation probability assessment. The vulnerability is not listed in the CISA KEV catalog, and no public proof-of-concept exploit has been identified, placing real-world urgency below that of a KEV-listed or PoC-available flaw. However, BIND 9 is among the most widely deployed DNS resolver and authoritative server implementations globally, meaning the aggregate attack surface is substantial even with the AC:H constraint. Patch availability from ISC further reduces urgency for patched environments, but unpatched resolvers in environments where DNS traffic traverses untrusted networks or where child-zone delegation exists to third parties should treat this as a priority.

An attacker who operates or has compromised a DNS zone delegated as a child of a domain that a target BIND resolver queries could serve specially crafted NSEC3 records. When the BIND resolver validates DNSSEC for a name in that delegation, it incorrectly accepts the malicious NSEC3 record as proof the queried name does not exist, returning an authenticated NXDOMAIN to downstream clients. No public proof-of-concept code has been identified, and the AC:H rating indicates this scenario requires deliberate setup rather than opportunistic exploitation.